Arobas Personnel is looking for an experienced Detection Engineer for a contract opportunity with one of our clients in Montreal .
The Detection Engineer will support the organization’s Splunk-based detection setting , working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.
Key Responsibilities Ensure operational continuity of the Splunk-based detection stack
Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments
Design, develop, and deploy new Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team
Map new and existing detections to MITRE ATT&CK; to track detection coverage
Develop and refine detection content for Purple Team exercises , incorporating identified gaps and post-exercise improvements
Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction
Maintain detection logic under version control and document tuning rationale
Track and manage work items in Jira
Participate in handoffs and collaboration sessions with Incident Response, CTI, SOC, and Red Team stakeholders
Key Deliverables Tuned and updated Splunk detection rules addressing Incident Response requests, with documented rationale
New detection use cases covering CTI-identified threat patterns , mapped to MITRE ATT&CK;
Detection content supporting Purple Team exercises ,



including post-exercise improvements
Up-to-date documentation of detection logic and coverage gaps
Work items properly tracked and closed in Jira
Must-Have Skills Strong hands-on experience with Splunk , including SPL, correlation searches, dashboards, data models, and detection-as-code workflows
Proven Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production environment
Working knowledge of MITRE ATT&CK; for threat modeling and coverage mapping
Familiarity with relevant security telemetry and log sources, including EDR, Windows/Linux/Sysmon, network, and cloud logs
Experience with Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting
Understanding of Incident Response processes and the ability to translate tuning requests into actionable detection rule changes
Nice To Have Exposure to Purple Teaming and adversary emulation , including tools or approaches such as Atomic Red Team and Caldera
Scripting skills with Python and/or PowerShell for detection logic, automation, and tooling
Experience with Git for managing detection content as code
Experience with Jira in an Agile or operational environment
Ability to clearly document technical decisions and rationale for handoff to technical teams and management
Id 10059
Emplacement Montréal
Durée De L'emploi Temps Plein
Nombre D'emplois Vacants 1
Date Limite De Dépôt Dernière mise à jour 26-11-04 15:21

#J-18808-Ljbffr

📌 Detection Engineer (Quebec City)
🏢 Arobas Personnel
📍 Quebec City