Security Content Engineer — Sigma, SPL and KQL for NATO...

A multinational defence organisation is strengthening the detection engineering side of its security operations centre. This is not alert triage: you build the content the analysts depend on, measure whether it works, and close the gaps you find.

What you would be doing

• Designing, building and maintaining detection rules, alerts and analytics across SIEM, EDR and XDR, network detection and cloud security tooling.
• Writing detection logic in the languages that suit it — Sigma, SPL, KQL.
• Building detections around adversary behaviour and mapping them to the MITRE ATT&CK framework, with advanced persistent threats in mind.
• Turning threat intelligence and purple team findings into working automated detections.
• Running a proper detection lifecycle — design, development, testing, deployment, monitoring, improvement, review — and improving the quality metrics behind it.
• Assessing detection coverage across on-premise and cloud estates, and doing the gap analysis that says where to invest next.
• Reviewing newly ingested log sources against the common information model, auditing field extractions and event mappings, and chasing data owners when something does not line up.
• Supporting incident handlers and threat hunters when an investigation is live.

What you would bring

• Real detection engineering experience, and the version control and code review habits that make it repeatable.
• Hands-on work with a major SIEM and with endpoint and network detection tooling.
• Fluency in at least one detection language, and enough scripting to automate the rest.
• Familiarity with adversary tradecraft and with the ATT&CK framework as a working tool rather than a poster.
• Professional English, and the ability to explain a detection decision to people who did not write it.

The assignment is on-site near Mons.