Threat Detection Engineer📣 Job Ad

About the Role

As a Threat Detection Engineer at Cognna, you will be responsible for designing high-impact detection strategies, building automation, and enhancing Security Operations Center (SOC) operations. This role involves mentoring emerging cyber talent and fostering collaboration with teams across threat intelligence, incident response, and platform engineering. You will play a key role in advancing threat detection capabilities, optimizing SOC technology stacks, and contributing to proactive threat hunting and incident response efforts.

Key Responsibilities

• Design and build high-fidelity correlation rules and behavioral detections within Cognna's security platforms.
• Translate adversary tactics, techniques, and procedures (TTPs) from frameworks like MITRE ATT&CK, threat intelligence, and vulnerability data into actionable detection logic.
• Identify detection gaps and introduce new data sources to effectively cover evolving threat landscapes.
• Automate detection testing processes and maintain high detection quality over time.
• Lead the architecture and optimization of XDR, SIEM, and SOC technology stacks for scalability and resilience.
• Streamline log ingestion pipelines, encompassing parsing, normalization, and enrichment.
• Build scripts and automations using Python and/or PowerShell to enhance SOC efficiency.
• Integrate tools across the SOC stack to enable seamless workflows and response capabilities.
• Collaborate with threat intelligence and incident response teams to enrich detection use cases and support threat hunts.
• Provide Tier-3+ support for incident investigations and post-mortem analysis.
• Improve SOC playbooks, Standard Operating Procedures (SOPs), and detection engineering workflows.
• Stay updated on global and regional threats and evolve detection strategies accordingly.
• Ensure alignment with compliance frameworks such as NCA ECC and SAMA CSF.

Qualifications and Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or a related field.
• Hands-on expertise in developing and maintaining complex detection use cases.
• Strong understanding of attacker behavior, incident response fundamentals, and digital forensics.
• Exceptional analytical thinking and creative problem-solving abilities.
• Excellent communication skills in both English and Arabic, including technical reporting.
• Strong mentorship abilities and a collaborative spirit.
• Self-motivated, focused, and passionate about cyber defense.
• Capability to juggle priorities effectively under high-pressure situations.

Required Skills

• Threat Detection Engineering
• Automation
• SOC Operations
• Threat Intelligence
• Incident Response
• Platform Engineering
• Expertise in SIEM queries (SPL, KQL, Lucene), rule tuning, UEBA, and scaling
• Deep knowledge of EDR tools and endpoint detection tactics
• Network Security, including packet analysis (Wireshark), IDS/IPS, and NetFlow
• Advanced scripting skills in Python and/or PowerShell
• Mastery of Windows, Linux, and macOS logging, artifacts, and forensic value
• Skilled in translating threat intelligence into real-time detection logic
• Strong command of monitoring IaaS, PaaS, and SaaS environments

Additional Information

This full-time role requires 5-10 years of experience and is based in Riyadh, Saudi Arabia. Certifications such as SANS GIAC (GDAT, GMON, GCIA, GCTI, GCIH), Offsec (OSDA), INE (eCTHP, eCIR), and (ISC)2 CISSP, CSSLP are highly preferred. The position offers the opportunity to contribute to product development that shapes the future of cybersecurity, with on-site collaboration in our Riyadh office. Continuous growth is supported through certifications and training, and an ESOP program is available within a culture of trust.