Detection Engineer.

Where attack meets defence

DEFION has been protecting organizations since 2005. Our Detection Engineering team sits at the intersection of offence and defence: you take the findings from real attack simulations and Red Team exercises and translate them into detection rules that work on SIEM, EDR and XDR platforms.

You won't just consume threat intelligence; you will generate and apply it. You work in a multidisciplinary team alongside Red Teamers, Blue Teamers and threat hunters from our Barcelona office (or remotely).

The team is based in Spain and works in Spanish with most of our clients. English is the language we use to coordinate with our team in the Netherlands and with international clients. That is why we are looking for someone who lives in Spain, ideally near Barcelona.

What you would do

• Design, develop and tune detection rules on SIEM, EDR and XDR platforms (Sentinel, CrowdStrike, Cortex, Splunk and more)
• Analyse the results of attack simulations to identify weaknesses in security controls
• Develop detection and mitigation strategies for emerging threats using MITRE ATT&CK
• Manage exclusions and suppressions with documented criteria, reducing false positives without losing coverage
• Document every detection (logic, ATT&CK coverage and tests) so the SOC can operate it
• Automate and optimize processes with Python, PowerShell and Bash scripts

What we are looking for

Must have:

• Fluent Spanish (native or C1 level), spoken and written: it is the team's working language and the language we use with most of our clients
• Living in Spain, ideally near Barcelona. Other situations will be considered case by case
• 1-2 years of experience as a Detection Engineer or SOC Analyst creating or optimizing alerts on SIEM/EDR
• Knowledge of KQL (Kusto Query Language) and/or CQL (CrowdStrike Query Language)
• In-depth knowledge of Windows logs, telemetry and event analysis for proactive threat detection
• Solid knowledge of adversary TTPs based on MITRE ATT&CK
• Scripting skills in Bash, Python or PowerShell
• Knowledge of Windows and Linux system administration, TCP/IP, DHCP, DNS
• Purple team mindset: think like an adversary, improve defensive capabilities
• Clear communication in English for international collaboration

Nice to have:

• Experience with SIEM and EDR platforms such as Microsoft Sentinel/Defender, CrowdStrike, Cortex, Splunk, Elastic ELK, LogRhythm, QRadar, Chronicle or Wazuh
• Cybersecurity certifications or a master's degree in a related field
• Degree in Engineering, Cybersecurity or a related field