Security Detection Engineer (x/f/m)

Help us shape how we detect cyberattacks! As a Security Detection Engineer (m/f/d), you will analyze threat landscapes and attack techniques, derive relevant detection use cases, and develop the corresponding detection logic for our security systems. You will support the entire detection lifecycle, from analyzing potential attack paths and developing and documenting detections to testing and continuously optimizing existing detection rules. Hiring is led by Code Factory (CoFa), DKB's sister tech company, while employment is with DKB AG.

Responsibilities

You develop use cases and detection rules to continuously improve attack detection across our SIEM, EDR, cloud, and other security systems; You analyze current threats, attack techniques, and TTPs and translate them into suitable detection use cases, systematically applying the MITRE ATT&CK framework; You analyze log and telemetry data and assess which data sources are relevant for detecting attack techniques and suspicious behavior; You test and validate detection rules for effectiveness and continuously optimize them to reduce false positives while maintaining strong detection coverage; You assess existing detection coverage using MITRE ATT&CK, identify gaps, and develop measures to close them; You work closely with Threat Intelligence, Threat Hunting, and Incident Response, translating insights into new or improved detection rules; Together with your team, you further develop Detection-as-Code processes and contribute to versioning, reviews, testing, and automated deployment of detection content; You contribute ideas to continuously improve the detection strategy, processes, measures, and tools

Requirements

You have several years of professional experience in IT security and solid hands-on experience in Detection Engineering, ideally complemented by experience in Threat Hunting or a SOC environment; You have strong knowledge of the MITRE ATT&CK framework and experience translating attack techniques and TTPs into concrete detection use cases; You have experience with SIEM, EDR, or comparable detection platforms and are familiar with the relevant query and detection languages; You have a good understanding of relevant security telemetry and log sources, for example from endpoint, identity, network, cloud, Windows, and Linux environments; You work in a structured, analytical, and solution-oriented way and demonstrate a high degree of initiative and teamwork; You have very good German skills and good written and spoken English skills; A specific university degree is not required; vocational training or another professional background is welcome with relevant Detection Engineering experience