Opportunity at
TideEngineer, Threat Detection - 5
This London engineering position belongs to the Threat Detection and Response group, one of three groups inside the security engineering function, alongside Product Security and Identity.…
Career Tools
About This Role
This London engineering position belongs to the Threat Detection and Response group, one of three groups inside the security engineering function, alongside Product Security and Identity. The group develops a detection and automation platform that defends the company's own systems. The engineer helps decide the plan and order of work for a group of experienced engineers. Much of the day-to-day work involves security information and event management (SIEM) tooling. Duties…
Job Description
This London engineering position belongs to the Threat Detection and Response group, one of three groups inside the security engineering function, alongside Product Security and Identity. The group develops a detection and automation platform that defends the company's own systems. The engineer helps decide the plan and order of work for a group of experienced engineers.
Much of the day-to-day work involves security information and event management (SIEM) tooling. Duties include building bespoke parsers for internal applications, setting alert logic, analysing logs and adjusting detections so fewer harmless events trigger alarms. Automation is another major area, from adding context to incoming data to automatically purging phishing messages from staff inboxes.
The engineer also searches for sophisticated attackers across cloud platforms, in-house services and employee laptops and desktops running Windows and macOS. Other work includes writing detection rules with business teams, keeping those rules well tested and monitored, and creating internal tools that speed up investigations. Leading complex incident investigations and joining the on-call rota are both expected.
The posting suits a practical engineer who enjoys scripting, building complete automated workflows and teaching colleagues. The security teams share a Slack channel and hold joint stand-ups. The company says it accommodates both office-based and remote working.
Responsibilities
- Help define the plan and priorities for threat detection across the team
- Build bespoke log parsers, set alert logic and tune detections to cut false positives
- Create security automations for routine work, such as adding context to data and removing phishing emails
- Look for intruders across AWS, GCP, in-house applications and Windows and macOS endpoints
- Work with cross-functional teams to produce detection rules specific to the business
- Keep detections tested and monitored so the detection platform stays dependable
- Lead complex investigations and coordinate containment and recovery
- Join the on-call rota that supports security incident response
Requirements
- Strong knowledge of at least one SIEM platform: Splunk, Scanner, Sentinel or SecOps
- Understanding of attack and defence methods for cloud (AWS, GCP), SaaS (Google Workspace, Okta) and desktop environments
- Solid experience with security automation, from scripting to complete automated workflows
- Familiarity with SOAR tools and automating detection and response work
- Excellent spoken and written communication
- A hands-on approach and the drive to finish solutions
Qualifications
- Enthusiasm for passing knowledge on to colleagues
- A public code repository that showcases automation or scripting work (a bonus)
Core Skills
Benefits
- Competitive salary and share options
- Holiday allowance that stacks on top of public holidays
- Paid parental leave, including adoption
- Sabbatical options after completing milestone years
- Salary sacrifice schemes such as nursery fees and cycle-to-work
- Private family health insurance and life and accident cover
- Mental wellbeing support, a pension scheme and paid time off for volunteering or self-development
- Learning budget, up to 90 days a year working abroad, and a home office setup contribution
- Laptop ownership scheme and a daily breakfast spread with drinks
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the role based?
The listing places the role in London and marks it as on-site. The posting also says the company accommodates office-based and remote working for its teams.
Is an on-call commitment required?
Yes. The engineer would be on the rota that supports security incident response.
Which SIEM experience is needed?
Strong knowledge of one of Splunk, Scanner, Sentinel or SecOps is required.
Is a salary stated?
The posting does not state an exact salary. It mentions competitive salary and share options.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.