Lead Cloud Detection & Threat Modelling Engineer - AWS, Azure, Sentinel, Elastic Stack, SOAR

Project overview

Lead Cloud Detection & Threat Modelling Engineer - AWS, Azure, Sentinel, Elastic Stack, SOAR platforms

6 Month Fixed-Term Contract

£110k-£120k pro rata

100% remote

Build Detection Engineering, Threat Modelling & Security Automation Across Azure and AWS

We're looking for a hands-on Senior Cloud Detection Engineer to help mature and scale our cloud security monitoring, detection and response capabilities across a complex, global, multi-cloud environment.

This role is ideal for someone who has progressed from a Senior SOC Analyst background into Threat Modelling & Detection Engineering and is passionate about threat detection, attack path analysis, automation, and incident response engineering.

Working closely with the CISO, Security Engineering team and SOC partners, you'll own the end-to-end lifecycle of threat detection, from threat modelling and attack simulation through to detection development, automated response orchestration, tuning and continuous improvement.

What You'll Be Doing:

What We're Looking For:

Desirable:

Technical Environment:

Keywords: Detection Engineering, Threat Detection, SOC, Sentinel, Elastic Stack, KQL, EQL, Threat Modelling, Azure Security, AWS Security, Incident Response, SOAR, Tines, Tracecat, Threat Hunting, MITRE ATT&CK.

• Design, build and optimise detections across both Microsoft Sentinel and Elastic Stack
• Develop and maintain advanced detection content using KQL and EQL
• Lead end-to-end threat modelling exercises across Azure, AWS, applications, identities, APIs and cloud-native services
• Identify attack paths, control gaps and detection opportunities using frameworks such as MITRE ATT&CK
• Engineer and automate investigation and response workflows using tools such as Tracecat, Tines, Shuffle or similar SOAR platforms
• Build automated playbooks covering triage, containment, enrichment, escalation and response activities
• Conduct proactive threat hunting across cloud, endpoint, identity and application telemetry
• Collaborate with internal stakeholders and external SOC partners to continuously improve detection coverage
• Tune and refine alerting to improve signal quality and reduce false positives
• Create and maintain detection engineering documentation, response procedures and operational runbooks
• Drive measurable improvements in detection coverage against key attack techniques targeting cloud environments
• Previous experience as a SOC Analyst, Senior SOC Analyst, Threat Hunter or Detection Engineer
• 5+ years' experience within Cyber Security Operations, Detection Engineering or Threat Detection
• Strong hands-on experience with both:
• Microsoft Sentinel
• Elastic Stack (Elasticsearch, Kibana, Elastic Security)
• Demonstrable expertise writing and tuning detection content using:
• KQL (Kusto Query Language)
• EQL (Event Query Language)
• Proven experience delivering threat modelling across enterprise cloud platforms
• Deep understanding of attacker techniques, detection strategies and defensive security controls
• Strong knowledge of AWS security services including CloudTrail, GuardDuty, Security Hub and VPC Flow Logs
• Strong knowledge of Azure security monitoring and logging capabilities
• Experience building security automation and orchestration workflows using:
• Tracecat
• Tines
• Shuffle
• Or equivalent SOAR platforms
• Experience creating automated incident response playbooks from initial alert through containment and remediation
• Strong understanding of the MITRE ATT&CK framework and cloud attack techniques
• Excellent stakeholder management and communication skills
• Python or PowerShell Scripting experience
• Experience working with MDR, MSSP or external SOC providers
• Knowledge of detection-as-code methodologies
• Relevant certifications such as CISSP, GCIH, GCFA, GIAC, Azure Security Engineer or AWS Security Specialty

Project details

• Start: 0 - 4 weeks
• Duration: 6 months (fixed term)
• Location: 100% remote (UK only), GB