Lead Cloud Detection & Threat Modelling Engineer

Lead Cloud Detection & Threat Modelling Engineer – AWS, Azure, Sentinel, Elastic Stack, SOAR platforms ? 6 Month Fixed-Term Contract ? £110k-£120k pro rata ? 100% remote Build Detection Engineering, Threat Modelling & Security Automation Across Azure and AWS We're looking for a hands-on

Senior Cloud Detection Engineer

to help mature and scale our cloud security monitoring, detection and response capabilities across a complex, global, multi-cloud environment. This role is ideal for someone who has progressed from a Senior SOC Analyst background into Threat Modelling & Detection Engineering and is passionate about threat detection, attack path analysis, automation, and incident response engineering. Working closely with the CISO, Security Engineering team and SOC partners, you'll own the end-to-end lifecycle of threat detection, from threat modelling and attack simulation through to detection development, automated response orchestration, tuning and continuous improvement. What You'll Be Doing: Design, build and optimise detections across both

Microsoft Sentinel

and

Elastic Stack Develop and maintain advanced detection content using

KQL

and

EQL Lead

end-to-end threat modelling exercises

across

Azure, AWS , applications, identities, APIs and cloud-native services Identify attack paths, control gaps and detection opportunities using frameworks such as

MITRE ATT&CK Engineer and automate investigation and response workflows using tools such as

Tracecat, Tines, Shuffle or similar SOAR platforms Build automated playbooks

covering triage, containment, enrichment, escalation and response activities Conduct proactive threat hunting across cloud, endpoint, identity and application telemetry Collaborate with internal stakeholders and external SOC partners to continuously improve detection coverage Tune and refine alerting to improve signal quality and reduce false positives Create and maintain detection engineering documentation, response procedures and operational runbooks Drive measurable improvements in detection coverage against key attack techniques targeting cloud environments What We're Looking For: Previous experience as a

SOC Analyst, Senior SOC Analyst, Threat Hunter or Detection Engineer 5+ years' experience within Cyber Security Operations, Detection Engineering or Threat Detection Strong hands-on experience with both: Microsoft Sentinel Elastic Stack (Elasticsearch, Kibana, Elastic Security) Demonstrable expertise writing and tuning detection content using: KQL (Kusto Query Language) EQL (Event Query Language) Proven experience delivering

threat modelling across enterprise cloud platforms Deep understanding of attacker techniques, detection strategies and defensive security controls Strong knowledge of

AWS security services

including CloudTrail, GuardDuty, Security Hub and VPC Flow Logs Strong knowledge of Azure security monitoring and logging capabilities Experience

building security automation and orchestration workflows

using: Tracecat Tines Shuffle Or equivalent SOAR platforms Experience

creating automated incident response playbooks

from initial alert through containment and remediation Strong understanding of the MITRE ATT&CK framework and cloud attack techniques Excellent stakeholder management and communication skills Desirable: Python or PowerShell scripting experience Experience working with MDR, MSSP or external SOC providers Knowledge of detection-as-code methodologies Relevant certifications such as CISSP, GCIH, GCFA, GIAC, Azure Security Engineer or AWS Security Specialty Technical Environment: Keywords:

Detection Engineering, Threat Detection, SOC, Sentinel, Elastic Stack, KQL, EQL, Threat Modelling, Azure Security, AWS Security, Incident Response, SOAR, Tines, Tracecat, Threat Hunting, MITRE ATT&CK. ? 6 Month Fixed-Term Contract ? £110k-£120k pro rata ? 100% remote

TPBN1_UKTJ