Arobas Personnel is looking for an experienced

Detection Engineer for a contract opportunity with one of our clients in

Montreal . The Detection Engineer will support the organization’s

Splunk-based detection environment , working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections. Key Responsibilities

Ensure operational continuity of the

Splunk-based detection stack Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments Design, develop, and deploy new Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team Map new and existing detections to

MITRE ATT&CK; to track detection coverage Develop and refine detection content for

Purple Team exercises , incorporating identified gaps and post-exercise improvements Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction Maintain detection logic under version control and document tuning rationale Track and manage work items in

Jira Participate in handoffs and collaboration sessions with

Incident Response, CTI, SOC, and Red Team stakeholders Key Deliverables

Tuned and updated

Splunk detection rules addressing Incident Response requests, with documented rationale New detection use cases covering

CTI-identified threat patterns , mapped to MITRE ATT&CK; Detection content supporting

Purple Team exercises ,



including post-exercise improvements Up-to-date documentation of detection logic and coverage gaps Work items properly tracked and closed in

Jira Must-Have Skills

Strong hands-on experience with

Splunk , including SPL, correlation searches, dashboards, data models, and detection-as-code workflows Proven

Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production workplace Working knowledge of

MITRE ATT&CK; for threat modeling and coverage mapping Familiarity with relevant security telemetry and log sources, including

EDR, Windows/Linux/Sysmon, network, and cloud logs Experience with

Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting Understanding of

Incident Response processes and the ability to translate tuning requests into actionable detection rule changes Nice To Have

Exposure to

Purple Teaming and adversary emulation , including tools or approaches such as Atomic Red Team and Caldera Scripting skills with

Python and/or PowerShell for detection logic, automation, and tooling Experience with

Git for managing detection content as code Experience with

Jira in an Agile or operational environment Ability to clearly document technical decisions and rationale for handoff to technical teams and management Id

10059 Emplacement

Montréal Durée De L'emploi

Temps Plein Nombre D'emplois Vacants

1 Date Limite De Dépôt

Dernière mise à jour

26-11-04 15:21

📌 Detection Engineer (Winnipeg)
🏢 Arobas Personnel
📍 Winnipeg