Lead Engineer - SIEM & Detection Platforms

• Education: Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
• Technical expertise: At least five years of experience in detection engineering. Preferably, this is within security operations centres or detection engineering teams. Proven success leading detection initiatives and applying innovative ways at enterprise scale.
• Detection engineering fundamentals: Deep expertise in detection logic design, threat modelling, and coverage mapping; extensive experience developing detections across diverse platforms and environments for enterprise-scale operations.
• Threat detection frameworks: Comprehensive familiarity with MITRE ATT&CK, Cyber Kill Chain, and detection engineering methodologies; understanding of how adversary techniques manifest across technology domains and how detection logic must be adapted.
• Detection platforms and tooling: At least five years of hands-on experience with enterprise detection platforms, including SIEM, EDR, NDR, and cloud-native security services; advanced proficiency in platform-specific query languages, rule formats, and detection logic development.
• Threat intelligence integration: Working knowledge of how threat intelligence is consumed and translated into actionable detection logic; understanding of indicator types, threat actor TTPs, and detection prioritisation based on AstraZeneca's threat profile.
• Scripting and automation: At least three years of experience using scripting languages such as Python, PowerShell, or similar for detection logic development and automation; experience with detection-as-code practices and version control for detection content.
• Detection formats and standards: At least three years of experience with standardised detection formats, including Sigma rules, YARA signatures, and platform-specific query languages; ability to develop portable and maintainable detection logic.
• Performance optimisation: Deep understanding of detection tuning, false positive reduction, and query optimisation techniques; proven ability to balance detection accuracy with practical efficiency.
• OT/ICS detection considerations: Familiarity with operational technology environments and the unique constraints affecting detection in industrial settings; awareness of safety implications and availability requirements that influence detection approaches.
• Purple team collaboration: Experience working with offensive security teams to validate detection efficacy and identify coverage gaps; understanding of how adversary emulation informs detection improvement.
• Threat landscape knowledge: Working experience with threat intelligence, adversary TTPs, and attack techniques across cloud, on-premises, and OT environments; familiarity with how threats evolve and detection strategies must adapt.
• Global collaboration: Experience working in a global organisation with geographically dispersed teams and collaborators, including matrix working environments; ability to coordinate across time zones and cultural contexts.
• Stakeholder engagement: Substantial experience collaborating with security operations teams, incident responders, and threat intelligence analysts to identify, document, and address detection requirements; proven ability to manage relationships and communications with third-party suppliers and vendors.
• Problem-solving and innovation: Recognised internally as an expert problem solver for complex detection challenges; track record of designing, shaping, and implementing innovative detection solutions that address emerging threats.

• Certifications: Relevant security certifications related to detection development are preferred, for example GIAC GCIA, GCDA or GMON, platform-specific certifications, or threat hunting certifications.
• Implement innovative detection engineering solutions: Experience adopting new detection techniques, behavioural analytics, and computational intelligence methods; leading training and change management to ensure successful adoption.

When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.