Threat-Led Detection Engineer - Lead
hace 2 días
Madrid
ppbThe Threat-Led Detection Engineer Lead /b will drive WTW’s detection engineering capability within the Global Information and Cyber Security Defence (ICSD) function, owning the strategy, quality, and continuous improvement of how WTW detects threats across its global estate in AI era. This role blends deep technical detection expertise with team leadership, driving a threat-led, intelligence-informed approach to detection that maps directly to real adversary behaviour. /p pThe Lead will set the standard for how detections are designed, written, tested, documented, and maintained – championing Detection-as-Code, measurable detection coverage, and a strong engineering culture. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), Incident Response, and Vulnerability /p pManagement teams, the Lead will ensure WTW’s detection library evolves ahead of the threat landscape.br/The individual will work as part of a global, multi-disciplined security community with strong support across the business, helping to foster a security-aware culture while ensuring WTW remains a great place to work. With WTW’s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required. /p pThe Threat-Led Detection Engineer Lead will grow WTW’s detection engineering function within the Global Cyber Security Defence team. Responsibilities of this role will include: /p ul liDrive WTW’s detection engineering strategy, setting the vision, standards, and roadmap for threat-led detection across cloud, endpoint, identity, network, and SaaS environments. /li liLead, mentor, and grow a team of detection engineers, establishing engineering best practices, peer review, and a culture of high-quality, well-documented detections. /li liDrive a threat-led detection approach, prioritising detection development against adversary tradecraft using the MITRE ATTCK framework, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis. /li liTranslate Cyber Threat Intelligence and threat-hunting findings into robust, high-fidelity detections with low false-positive rates. /li liEstablish, own, and maintain the central detection library, ensuring detections are version-controlled, tested, documented, and mapped to MITRE ATTCK coverage. /li liChampion Detection-as-Code, implementing Git-based workflows, CI/CD pipelines, automated testing, and peer review for all detection content. /li liDefine and track detection coverage, efficacy, and quality metrics (e.g. ATTCK coverage, detection fidelity, time-to-detect) and report on detection posture to senior leadership. /li liLead detection validation and tuning through adversary emulation, purple-team exercises, and breach-and-attack-simulation tooling (e.g. Atomic Red Team, Caldera). /li liSupport the integration of AI and automation into detection workflows – including AI-assisted detection authoring, enrichment, and triage – and lead detection efforts for AI/GenAI-specific threats. /li liPartner with SOC, Threat Hunting, CTI, Incident Response, and Vulnerability Management to close detection gaps identified during incidents and hunts. /li liGovern the full detection lifecycle: intake, development, testing, deployment, monitoring, tuning, retirement, and continuous improvement. /li liEvaluate and onboard new log sources, telemetry, and tooling to expand detection coverage across the global estate. /li liSet standards for detection documentation, runbooks, and response guidance so every detection is clear and actionable for the SOC. /li /ul h3Qualifications /h3 pWe are looking for a candidate for the Threat-Led Detection Engineer Lead role who has the following: /p pbMust-have /b /p ul li5+ years in cyber security with detection engineering experience, including a track record of leading, mentoring, or coordinating technical teams. /li liStrong cyber security mindset with a deep, thorough understanding of adversary behaviour, attacker tradecraft, and the modern threat landscape. /li liExpert knowledge of the MITRE ATTCK framework, the Cyber Kill Chain, and the Diamond Model, with proven ability to map and drive detection coverage against them. /li liProven expertise writing, testing, and maintaining detection rules across SIEM and EDR/XDR platforms (e.g. Microsoft Sentinel, Splunk, Elastic, CrowdStrike, Microsoft Defender XDR), using query languages such as KQL, SPL, EQL, or Sigma. /li liDemonstrated ability to develop high-fidelity detections swiftly in response to emerging threats, intelligence, and live incidents. /li liExperience owning and maturing a detection library, including detection lifecycle governance and ATTCK coverage mapping. /li liHands‑on experience with Detection-as-Code: Git, version control, CI/CD pipelines, and automated testing of detection content. /li liUnderstanding of AI/ML in security operations and awareness of AI‑specific threats (prompt injection, model/data poisoning, sensitive‑data exposure via GenAI), with familiarity with the OWASP LLM Top 10 and MITRE ATLAS. /li liExceptional written and verbal communication skills, able to convey complex technical concepts to both engineers and non‑technical stakeholders, including executives. /li /ul pbGood to have /b /p ul liStrong threat‑hunting mindset and hands‑on hunting experience to proactively surface detection gaps and feed detection development. /li liScripting and automation skills (e.g. Python, PowerShell) for tooling, enrichment, and SOAR integration. /li liFamiliarity with detection data pipelines (log routing, parsing, normalisation, data lakes) and how they affect detection quality. /li /ul pWe’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email /p h3Job Info /h3 ul liJob Identification /li liJob Category Information and Cyber Security /li liPosting Date 06/29/2026, 02:14 PM /li /ul /p #J-18808-Ljbffr
Camareros
Ventas y Marketing
Chef y Cocinero
Venta Minorista
Estética y Belleza
Construcción y Obras
Comida Rápida
Almacén
Arte, Medios de Comunicación, Diseño
Atención Sanitaria
Ayudante de Cocina
Azafato y Azafata
Barista
Ciencia
Contabilidad y Finanzas
Cuidado de animales
Cuidado de niños
Deportes y Bienestar
Educación
Entretenimiento
Eventos y Promociones
Gerencia
Industria y Producción
Ingenieria
Limpieza
Moda
Oficina y Administración
Personal de Bar
Redacción y Edición
Seguridad
Servicio al Cliente
Servicios Jurídicos
Tecnología de la información
Trabajos en línea
Transporte y Reparto
Otros