Cyber Security Engineer – Detection & Response

About the role

The Security Engineer in the Cyber Defence team is a senior, hands‑on defender who builds, tunes and operates detection and response capabilities to protect BoyleSports against active threats. Working closely with the Head of Cyber Security, the role focuses on creating defensive rules, automations, integrations and tooling.

Key responsibilities

• Design, write, test and tune detections across Cortex XDR/XSIAM, AWS CloudTrail, GuardDuty, EKS audit logs, Entra ID, on‑prem AD, endpoint, network and application logs.
• Treat detections as code: version‑control, peer‑review, test, map to MITRE ATT&CK and retire outdated rules.
• Onboard and parse new log sources, collaborating with platform and application teams.
• Run structured threat hunts based on intelligence, recent incidents and gambling‑specific attack patterns.
• Lead deep‑dive investigations of alerts escalated from the Palo Alto MSSP, documenting findings for future analysts.
• Stand on the bridge during P1/P2 incidents, drive containment, eradication and post‑incident reporting.
• Build and maintain SOAR playbooks, automating triage, enrichment, containment and notification.
• Integrate detection and response tooling with ticketing, chat, identity and cloud control planes using clean, supportable code.
• Serve as primary technical interface to the Palo Alto managed SOC, reviewing detections and providing feedback.

Required profile

• Senior‑level security professional with extensive hands‑on experience in detection engineering and incident response.
• Proven ability to design and operate large‑scale detection platforms and conduct threat hunting.
• Strong analytical skills and ability to document investigations for regulatory and internal use.
• Comfortable working in fast‑paced, high‑impact incidents and collaborating across engineering teams.

Required skills

• Cortex XDR / XSIAM
• AWS CloudTrail, GuardDuty, EKS audit logs
• Microsoft Entra ID and on‑premises Active Directory
• MITRE ATT&CK framework
• Palo Alto Networks Managed SOC (MSSP)
• SOAR playbook development
• Version‑control systems (e.g., Git)
• Detection engineering, threat hunting and incident response