JOIN OUR TEAMAt Levi Nine we are passionate about what we do. We love our work and together in a team we are smarter and stronger. We work in a dynamic and challenging environment with talented and forward-thinking people who are part of creative and innovative teams. We are looking for skilled team players who make change happen. Are you one of these players?OUR PARTNER:Our partner, ABN AMRO Clearing, is a global leader in the domain of clearing, offering access to a wide range of listed instruments on markets across the globe.IT is at the heart of their organization with more than 30 different product teams and 10 different platform teams that are trying to build the best products & services for their customers.Their presence in important financial centers like Amsterdam, Chicago, Sydney, Singapore, Tokyo Hong Kong, London, Sao Paulo, Frankfurt and Iasi, allows them to effectively serve clients worldwide and maintain close proximity to their diverse customer base.THE ROLE INVOLVES:As a Senior SOC Analyst (L3) – Detection Lead, you own the Detection Engineering capability within the SOC, with a strong focus on Splunk Enterprise Security.You play a key role in a SOC build-up phase, establishing a scalable detection foundation from the ground up.You define detection strategy, ensure high-quality detection coverage aligned with the threat landscape, and guide L2 engineers in building effective detections.This role bridges detection engineering, threat hunting, and incident response, acting as the technical authority within the SOC.Responsibilities:Define and drive the detection strategy and roadmap.Ensure high-quality, high-fidelity detections in SIEM (Splunk).Map detection coverage to MITRE ATT&CK and identify gaps.Mentor L2 detection engineers.Define detection standards and best practices.Drive continuous improvement of detection quality and efficiency.Support complex investigations and threat-driven detection improvements.Collaborate with the SIEM/platform engineering team to define detection requirements and required data sources, without owning ingestion or platform maintenance.TECHNICAL PLAYGROUND:5+ years of experience in cybersecurity with strong focus on detection engineering / threat hunting / incident responseStrong experience with SIEM platforms (preferably Splunk ES)Proven ability to define detection strategy and standardsDeep expertise in:MITRE ATT&CKRisk-Based Alerting (RBA)SIGMA rulesExperience with Detection as Code (DaC) and structured detection engineering approaches (e.g., OpenTIDE)Strong understanding of attacker TTPs and detection mappingAbility to mentor and guide engineers, raising the overall technical maturity of the teamStrong collaboration skills, especially with platform engineering teams and other security domainsAbility to work at both strategic (what to detect) and tactical (how to detect it) levelsNICE TO HAVE:Certifications such as the following would be desirable but not mandatory: GCIH, GDAT, GCDA, GISP, OSDA, CCFR, SC-900, SC-200, SplunkExperience with SOAR, CI/CD, adversary emulationExperience building SOC capabilities from scratchA keen interest in cyber security and a desire to learn more and improve the current way of workingRelevant university degree in Computer Science, Engineering, or a related fieldSOFT SKILLS:Fluent English, with good written and verbal communication skillsStrong analytical and strategic thinkingCoaching and mentoring mindsetOwnership and proactive approachClear communication across technical and non-technical stakeholdersDesire to continuously learn and improve in a complex, rapidly evolving environment Show more Show less