Security Engineer (Detection & Response) at Refractal
United Kingdom
Posted
on-site · full_time · Visa sponsorship
Apply for this role at Refractal
Responsibilities:
- Translate detection and investigation workflows into actionable product requirements and test cases.
- Use SIEMs (Splunk, Datadog) and detection-rule experience to inform product design and integration priorities.
- Write realistic threat examples and test cases that capture attacker behaviour and common false-positive sources.
- Evaluate product outputs for detection quality, contextual usefulness and analyst effort to reach decisions.
- Work with customers and teams to prioritise gaps, validate fixes and close the feedback loop between practitioners and engineers.
Requirements:
- Hands-on experience writing and tuning detection rules, with examples of evaluation and iteration.
- Practical experience using SIEM platforms (Splunk, Datadog) to query telemetry and investigate incidents.
- Strong understanding of analyst workflows, false positives and coverage gaps in security telemetry.
- Ability to explain security problems clearly to engineers and convert practitioner needs into requirements.
- Interest in product development and willingness to test assumptions with evidence from practical security work.
- Nice-to-have: scripting skills for data prep and prior contribution to security products or engineering teams.