Senior Security Engineering Consultant

In this senior, customer-facing role you will design, implement and evolve detection and response capabilities across SIEM, XDR and SOAR platforms. You work within Nomios’ Security Operations team to boost customers’ SOC maturity through detection engineering, automation and playbooks. You will own detection-as-code practices, deliver use-case driven detections aligned to MITRE ATT&CK, and collaborate with platform/onboarding teams to ensure practical, scalable outcomes. This role combines hands-on engineering with advisory responsibilities in a fast-paced environment.

• remote/hybrid work
• competitive salary
• performance-based bonuses
• industry-leading benefits
• office perks (free drinks, snacks)
• travel to customer sites as needed

• Design and deliver detection rulesets across SIEM and XDR
• Tune detection logic using KQL or equivalent
• Create detection use cases aligned to MITRE ATT&CK and real-world techniques
• Map customer log sources to use cases to assess coverage and gaps
• Design and implement SOAR automations and response workflows
• Develop incident response playbooks aligned to detections
• Translate threat intel into improved detections and automations
• Deliver detection-as-code pipelines with versioning
• Produce technical deliverables like strategies, use case catalogs, and coverage assessments
• Lead workshops on detection engineering and SOC maturity
• Guide customers on detection coverage improvements and MITRE ATT&CK alignment
• Collaborate with onboarding and engineering teams to ensure seamless integration
• Support SOC teams to ensure outputs are practical and usable
• Contribute to evolving detection content and delivery standards
• Identify telemetry gaps and recommend improvements

• Hands-on SIEM engineering with experience in Microsoft Sentinel preferred
• Experience writing detection logic with KQL or similar
• Proven SOAR automation and playbook design (Logic Apps, Cortex XSOAR or similar)
• Scripting/automation skills (Python, PowerShell, APIs)
• Detection use cases aligned to MITRE ATT&CK
• Understanding of log source mapping to attack lifecycle
• Experience with XDR/EDR (Microsoft Defender, CrowdStrike, Cortex)
• Cloud security telemetry in Azure
• Customer-facing or consultancy experience
• Strong communication skills to explain technical concepts to diverse audiences

• Collaborative
• Clear communication
• Curiosity and willingness to learn
• SIEM and XDR platforms (Microsoft Sentinel, Microsoft Defender, Palo Alto XSIAM/XDR, CrowdStrike, SentinelOne)
• SOAR development and playbook design (Palo Alto XSOAR)
• KQL and similar query languages