Senior Detection Engineer | SecOps
Read straight from ARQ's careers page, verified 6h ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationLondon
Work modehybrid
Typefull-time
SenioritySenior
Experience5+ yrs
DepartmentSecurity
EquityIncluded
Company size201–500 people
PostedOct 30, 2026 · 1w ago
Verified live6h ago
At a glanceSummarised by Seekless from the posting.
5+ years in security, including 3+ years writing and owning detections in production
Hands-on experience with a cloud SIEM and its query language (Datadog Cloud SIEM, Splunk, Elastic, Google SecOps)
Deep knowledge of AWS logs, particularly CloudTrail, IAM and IAM Identity Center
Experience with SaaS audit logs such as Google Workspace, GitHub, GitLab or Okta
Experience managing detections as code using Terraform, Git, CI pipelines and code review
Practical experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team
Python skills for automation, log analysis and security tooling
Hands-on incident response experience
Ability to work independently in a small team
Strong written and verbal communication in English
Familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust or WAF
Experience working with Kubernetes (EKS) audit logs
Threat hunting, red team or purple team experience
Experience building agentic workflows using Claude or OpenAI
Background in fintech, payments or crypto, with exposure to SOC 2 or PCI DSS
Spanish or Portuguese language skills
Skills
Datadog Cloud SIEM
Splunk
Elastic
Google SecOps
AWS
CloudTrail
IAM
IAM Identity Center
Google Workspace
GitHub
GitLab
Okta
Terraform
Git
CI pipelines
Python
Atomic Red Team
Stratus Red Team
CrowdStrike Falcon
Datadog SIEM
Cloudflare Zero Trust
WAF
Kubernetes (EKS)
Claude
OpenAI
Benefits
Stock options
Performance bonus
What we’re looking for
You’ll own detection engineering and help shape how ARQ detects and responds to threats. From bringing new log sources into ARQ’s SIEM to writing, testing and tuning detections, you’ll be responsible for making sure our coverage works when it matters.
We’re looking for someone who combines hands-on detection experience with an engineering mindset. You’ll work directly with our CISO and a small global security team, with the autonomy to prioritise gaps and build practical solutions. Automation is central to how we work: you’ll build and run AI agents that support rule development, validation, alert triage and threat hunting, with you reviewing and approving their output.
What you’ll do
•
Own detection engineering end to end in Datadog Cloud SIEM: identify missing log sources, prioritise onboarding and build reliable detection coverage.
•
Write, test and tune detection rules, reducing false positives while keeping meaningful threats visible.
•
Map coverage to MITRE ATT&CK and validate it by reproducing attacker activity.
•
Manage detections as code, using version control, CI pipelines and code review.
•
Build and run automation and AI agents for rule authoring, detection validation, coverage mapping, alert triage and threat hunting.
•
Investigate security incidents, including triage, scoping, evidence collection and clear incident write-ups.
•
Help develop automated response and containment capabilities.
•
Track and communicate detection coverage, validation results and response performance to security leadership.
What you’ll need
•
5+ years in security, including 3+ years writing and owning detections in production.
•
Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, Google SecOps.
•
Deep knowledge of AWS logs, particularly CloudTrail, IAM and IAM Identity Center, alongside experience with SaaS audit logs such as Google Workspace, GitHub, GitLab or Okta.
•
Experience managing detections as code using Terraform, Git, CI pipelines and code review.
•
Practical experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.
•
Python skills for automation, log analysis and security tooling, with a record of shipping automation or AI agents that others use.
•
Hands-on incident response experience, from investigating alerts to documenting findings and remediation.
•
The ability to work independently, prioritise effectively and own outcomes in a small team without a dedicated SOC behind you.
•
Strong written and verbal communication in English.
Nice to have
•
Familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust or WAF.
•
Experience working with Kubernetes (EKS) audit logs.
•
Threat hunting, red team or purple team experience.
•
Experience building agentic workflows using Claude or OpenAI.
•
A background in fintech, payments or crypto, with exposure to SOC 2 or PCI DSS.
•
Spanish or Portuguese language skills.
Benefits
•
Competitive salary and benefits
•
Stock options, so you own part of what you build
•
Discretionary performance bonus
•
The latest tools and technology
•
A world-class team that will challenge and grow your skills
•
The opportunity to help build the best fintech app in Latin America
•
Office Policy: 3-4 days a week in-office