Arobas Personnel is looking for an experienced Detection Engineer for a contract opportunity with one of our clients in Montreal .

The Detection Engineer will support the organization’s Splunk-based detection environment , working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.

Key Responsibilities ? Ensure operational continuity of the Splunk-based detection stack ? Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments

? Design, develop, and deploy recent Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team

? Map new and existing detections to MITRE ATT&CK; to track detection coverage

? Develop and refine detection content for Purple Team exercises , incorporating identified gaps and post-exercise improvements

? Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction ? Maintain detection logic under version control and document tuning rationale

? Track and manage work items in Jira ? Participate in handoffs and collaboration sessions with Incident Response, CTI, SOC, and Red Team stakeholders Key Deliverables ? Tuned and updated Splunk detection rules addressing Incident Response requests, with documented rationale

? New detection use cases covering CTI-identified threat patterns , mapped to MITRE ATT&CK;





? Detection content supporting Purple Team exercises , including post-exercise improvements

? Up-to-date documentation of detection logic and coverage gaps ? Work items properly tracked and closed in Jira Must-Have Skills ? Strong hands-on experience with Splunk , including SPL, correlation searches, dashboards, data models, and detection-as-code workflows

? Proven Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production environment

? Working knowledge of MITRE ATT&CK; for threat modeling and coverage mapping

? Familiarity with relevant security telemetry and log sources, including EDR, Windows/Linux/Sysmon, network, and cloud logs ? Experience with Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting

? Understanding of Incident Response processes and the ability to translate tuning requests into actionable detection rule changes

Nice To Have ? Exposure to Purple Teaming and adversary emulation , including tools or approaches such as Atomic Red Team and Caldera

? Scripting skills with Python and/or PowerShell for detection logic, automation, and tooling

? Experience with Git for managing detection content as code

? Experience with Jira in an Agile or operational environment

? Ability to clearly document technical decisions and rationale for handoff to technical teams and management

Id 10059 Emplacement Montréal Durée De L'emploi Temps Plein Nombre D'emplois Vacants 1 Date Limite De Dépôt Dernière mise à jour:

26-11-04 15:21

📌 Detection Engineer (Montreal)
🏢 Arobas Personnel
📍 Montreal