# Security Detection & Automation Engineer at JustMarkets Security Detection & Automation Engineer at JustMarkets in Europe. Full-time. Posted November 3, 2026. - Company: JustMarkets - Location: Europe - Job type: Full-time - Posted: 2026-11-03 - Apply: https://job-boards.eu.greenhouse.io/justmarkets/jobs/5013383101 - Source: https://jobmagic.ai/jobs/security-detection-automation-engineer-justmarkets-jnykn4 ## Requirements - Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action. - Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools. - Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques. - Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows. - Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work. - Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover. - Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes. - Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps. - Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work. - Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required. - Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence. ## Description We are inviting you, a highly motivated and results-oriented **Detection Engineer** to join our team on a full-time basis. Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success. **Responsibilities** - Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage. - Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners. - Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions. - Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs. - Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use. - Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps. - Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope. - Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path. - Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager. **Requirements** - Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action. - Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools. - Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques. - Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows. - Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work. - Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover. - Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes. - Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps. - Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work. - Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required. - Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence. **Will be a plus** - Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices. - Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments. **We offer** - 20 paid vacation days per year - 10 paid sick leave days per year - Public holidays as per the company's approved Public holiday list - Medical budget - Opportunity to work remotely - Professional education budget - Language learning budget - Wellness budget (gym membership, sports gear and related expenses)