Own detection engineering at ARQ, shaping threat detection and response in a collaborative global security team.
Posted by employer 1 day ago
First seen on Joblaze 1 day ago
Last verified on the company career page 1 day ago
Skills & Technologies
What you'll build
- Own detection engineering end to end in Datadog Cloud SIEM
- Write, test and tune detection rules
- Map coverage to MITRE ATT&CK
- Build and run automation and AI agents
- Investigate security incidents
Must have
- 5+ years in security
- 3+ years writing and owning detections in production
- Hands-on experience with a cloud SIEM
- Deep knowledge of AWS logs
- Experience managing detections as code
- Strong written and verbal communication in English
Nice to have
- Familiarity with CrowdStrike Falcon
- Experience working with Kubernetes (EKS) audit logs
- Threat hunting, red team or purple team experience
- Experience building agentic workflows using Claude or OpenAI
- A background in fintech, payments or crypto
- Spanish or Portuguese language skills
Practical constraints
- 3-4 days a week in-office
AI in the day-to-day
You'll build and run AI agents that support rule development, validation, alert triage and threat hunting.
Requirements
- Experience
- 5+ years
Not disclosed in this posting: compensation, visa sponsorship.
Benefits
Joblaze summary
In this role, the Senior Detection Engineer at ARQ is responsible for end-to-end detection engineering, which includes onboarding log sources and developing reliable detection coverage within Datadog Cloud SIEM. The position requires a strong background in security, particularly with cloud SIEMs and AWS logs, along with skills in automation and coding, especially in Python. Ideal candidates will have over five years of experience in security, including hands-on detection work and incident response, and should be comfortable working independently in a small team environment.
Joblaze insights
- Listed yesterday — first seen on Joblaze October 31, 2026. Last confirmed on ARQ's careers page October 31, 2026.
Quick facts
- Is the Senior Detection Engineer | SecOps role remote?
- It's hybrid — ARQ expects some on-site time in London, United Kingdom.
- How much experience is required?
- At least 5 years of relevant experience for this Senior Detection Engineer | SecOps role.
- Where is the role based?
- ARQ is hiring for this position in London, United Kingdom.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: AWS, Atomic Red Team, CI pipelines, CloudTrail, CrowdStrike Falcon, Datadog Cloud SIEM.
- What seniority level is this role?
- ARQ targets senior candidates for this position.
- Is this full-time or contract?
- Full-time for this Senior Detection Engineer | SecOps role at ARQ.
From the original posting
What we're looking for
You'll own detection engineering and help shape how ARQ detects and responds to threats. From bringing new log sources into ARQ’s SIEM to writing, testing and tuning detections, you'll be responsible for making sure our coverage works when it matters.
We're looking for someone who combines hands-on detection experience with an engineering mindset. You'll work directly with our CISO and a small global security team, with the autonomy to prioritise gaps and build practical solutions. Automation is central to how we work: you'll build and run AI agents that support rule development, validation, alert triage and threat hunting, with you reviewing and approving their output.
What you'll do
Own detection engineering end to end in Datadog Cloud SIEM: identify missing log sources, prioritise onboarding and build reliable detection coverage.
Write, test and tune detection rules, reducing false positives while keeping meaningful threats visible.
Map coverage to MITRE ATT&CK and validate it by reproducing attacker activity.
Manage detections as code, using version control, CI pipelines and code review.
Build and run automation and AI agents for rule authoring, detection validation, coverage mapping, alert triage and threat hunting.
Investigate security incidents, including triage, scoping, evidence collection and clear incident write-ups.
Help develop automated response and containment capabilities.
Track and communicate detection coverage, validation results and response performance to security leadership.
What you'll need
5+ years in security, including 3+ years writing and owning detections in production.
Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, Google SecOps.
Deep knowledge of AWS logs, particularly CloudTrail, IAM and IAM Identity Center, alongside experience with SaaS audit logs such as Google Workspace, GitHub, GitLab or Okta.
Experience managing detections as code using Terraform, Git, CI pipelines and code review.
Practical experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.
Python skills for automation, log analysis and security tooling, with a record of shipping automation or AI agents that others use.
Hands-on incident response experience, from investigating alerts to documenting findings and remediation.
The ability to work independently, prioritise effectively and own outcomes in a small team without a dedicated SOC behind you.
Strong written and verbal communication in English.
Nice to have
Familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust or WAF.
Experience working with Kubernetes (EKS) audit logs.
Threat hunting, red team or purple team experience.
Experience building agentic workflows using Claude or OpenAI.
A background in fintech, payments or crypto, with exposure to SOC 2 or PCI DSS.
Spanish or Portuguese language skills.
Benefits
Competitive salary and benefits
Discretionary performance bonus
The latest tools and technology
Office Policy: 3-4 days a week in-office
Standard company text repeated across ARQ's postings is omitted here.