Staff Security Engineer (Detection)

• We're taking an engineering-led approach to security operations, building internal capability and technical depth. You'll provide technical accountability for REA's detection-engineering capability and help shape how we evolve detection and automation

•

The Staff Security Engineer is a key role in the Detections & Response team that will provide technical accountability for REA's detection engineering capability within our purpose-built detection platform. You'll shape standards, technical direction and the capability model across data flows, detection requirements, testing and response automation. Working within our strategic goals, you'll partner with the team to prioritise and sequence the work that delivers them, bringing deep technical expertise to guide how we get there.

Day to day of the job

• Identify, initiate and lead long-term, cross-team initiatives that strengthen REA's detection and response capability, aligning stakeholders and driving delivery in partnership with Product, Platform and Engineering teams.
• Configure and operate the detection platform and its data flows, including log ingestion, transformation, alert enrichment and response automation, while shaping the technical standards and patterns used to define and validate detections.
• Define detection patterns and technical approaches to identify malicious activity across our environment, and lead the review, tuning and validation of high-fidelity detections and correlation logic that improve coverage, reduce false positives and enable the team to scale detection engineering capabilities.
• Build and maintain automated pipelines, infrastructure, tests and quality gates that validate detections and protect against configuration drift, regressions and coverage gaps.
• Analyse security events and logs to identify malicious activity, patterns and emerging attack techniques during investigations and proactive threat hunting
• Assess threat intelligence, attacker techniques and relevant industry frameworks in the context of REA's environment, using them to set detection priorities and guide refined detection patterns that continuously improve coverage and signal quality.
• Investigate security alerts and incidents, independently determine whether containment is required, coordinate technical response activities and communicate effectively with the wider incident response team, senior management and business stakeholders as needed
• Produce and automate response playbooks to ensure rapid and effective containment and response
• Contribute to purple-team exercises and security testing to validate effectiveness of detections and identify gaps
• Partner with Product, Platform and Engineering teams to ensure new systems and changes have appropriate logging, monitoring and detection coverage
• Evaluate and use AI-assisted and other emerging tooling to improve detection, support investigations and response automation, applying sound security judgement and attacker-technique knowledge to guide investigative tasks and validate outputs.
• Mentor and share knowledge with other Security and Engineering team members through reviews, pairing and internal forums

• Ability to define detection engineering architectures, patterns and standards across multiple platforms, balancing detection coverage, signal quality, cost, performance, and operational impact
• Strong understanding of cloud and application architectures, including logging, monitoring, native security controls and common failure modes, with ability to translate these into detection and response requirements
• Proficiency in log analysis, scripting and query languages to investigate security events and evaluate detection behaviour, with the ability to define requirements for, review and validate complex detection logic, including edge cases and performance considerations.
• Capability to configure and manage data pipelines, including log forwarding, transformation, cost-conscious ingestion strategies, and observability pipeline tools
• Deep understanding of security observability tooling including EDR, SIEM, CNAPP, SOAR, and identity platforms, with ability to leverage their telemetry for high-fidelity detections
• Strong knowledge of attacker techniques and kill-chain concepts (e.g. MITRE ATT&CK) and how to map them into effective detections and coverage assessments
• Strong understanding of modern DevOps and systems-engineering practices, including detection-as-code, source-control workflows, infrastructure-as-code and CI/CD pipelines, with the ability to define standards and quality controls for building, testing, deploying and operating security tooling.
• Ability to build automation workflows for security operations, including SOAR platforms and response orchestration, and document operational procedures through playbooks, runbooks and detection test cases

The physical, mental, emotional and financial health of our people is something we'll never stop caring about. This is a place to learn and grow.

Some of our Perks & Benefits include:

• A hybrid and flexible approach to working
• Flexible leave options including, birthday leave and purchase additional leave
• Flexible parental leave offering for primary and secondary carers
• Our Because We Care program offers employees volunteering leave, community grants, matched payroll giving and our Community Café donates 100% of revenue to charity
• Hackdays so you can bring your big ideas to life