Cyber Operate Detection Engineer, Consultant

About the Role

Join Deloitte's Cyber team to deliver powerful solutions that help clients navigate the ever-changing threat landscape and operate with resilience.

Key Responsibilities

• Review threat intelligence, emerging threats, attack techniques, vulnerabilities, and historical incident information to identify detection requirements.
• Develop, maintain, and update detection rules, queries, signatures, and indicators of compromise for security monitoring platforms.
• Configure and tune detections; identify false positives; and recommend improvements that maintain effective threat coverage.
• Test and validate detection rules against known threats and attack scenarios; document test results, configuration changes, and detection logic.
• Monitor detection performance; investigate gaps or unexpected results; support incident-response research; and collaborate with security operations center analysts, threat hunters, incident responders, Platform Operations Engineers, and client cybersecurity teams.

Requirements & Tech Stack

• Experience using at least one scripting or query language: Python, PowerShell, SQL, KQL, or SPL.
• Experience documenting technical findings, test results, configuration changes, or detection logic.
• Experience reviewing or analyzing authentication events, network traffic, operating system activity, vulnerability data, security logs, or alerts.
• Ability to work independently and collaborate as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships.
• Ability to lead projects or workstreams.
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment.
• Strong interpersonal skills and professional demeanor.
• Ability to meet deadlines.
• Ability to provide clear guidance to others.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, or Computer Engineering.
• 2+ years of experience in cybersecurity, security operations, threat intelligence, networking, or systems administration.

Preferred Qualifications

• Hands-on experience in a security operations center, with SIEM or EDR platforms, or in threat hunting, incident response, or detection engineering.
• Experience using Microsoft Sentinel, Splunk, Google Security Operations, Elastic, CrowdStrike, or Microsoft Defender.
• Experience creating or modifying Sigma rules, YARA rules, Suricata signatures, KQL queries, or SPL queries.
• Experience using Amazon Web Services, Microsoft Azure, or Google Cloud.
• Experience using Git, version control systems, detection-as-code practices, or CI/CD processes.
• CompTIA Security+, CompTIA CySA+, or GIAC certification.