Detection Engineer - Security Exposure & Third-Party Cyber Assurance

Role Overview

We are looking for a Detection Engineer to support the build-out and operations of the Security Exposure and Third-Party Cyber Assurance Centre of Excellence, under Cybersecurity Assurance and Defense (CASD) - External Threat Operations.

The role will provide hands-on technical and operational support across two key areas:

Security Exposure Management (SEM): Continuous, outside-in monitoring of the organisation and its portfolio companies internet-facing attack surface.
Third-Party Cyber Assurance (TPCA): Cybersecurity due diligence and continuous assurance across third parties and the broader supply chain.

The successful candidate will operate continuous monitoring platforms, conduct third-party cyber assessments, validate active and emerging threats, and coordinate remediation to reduce the time between exposure identification and potential exploitation.

Key Responsibilities

Operate and maintain always-on security exposure and external threat monitoring platforms.
Monitor the organisation, portfolio companies, and third parties for internet-facing vulnerabilities, exposures, and emerging cyber threats.
Perform Attack Surface Management (ASM/EASM) activities to identify, assess, validate, and prioritise external security exposures.
Conduct third-party/vendor cybersecurity assessments, including security questionnaires and due diligence activities such as VDD, ODD, and SIG.
Assess third-party security controls against established frameworks including NIST, ISO 27001, and CIS Controls.
Leverage Cyber Threat Intelligence (CTI), digital risk, and dark-web monitoring to identify and validate relevant threats.
Investigate and validate high-risk or imminent security threats and coordinate appropriate remediation with relevant stakeholders.
Analyse third- and fourth-party cyber risks and their potential impact across the organisation and supply chain.
Develop scripts and automation using Python, PowerShell, or Bash to streamline monitoring, analysis, reporting, and operational activities.
Build and maintain operational dashboards, reporting capabilities, and cyber posture metrics using data lake platforms.
Document findings, processes, assessments, and remediation actions clearly for both technical and business stakeholders.
Support continuous improvement of detection logic, control baselines, monitoring processes, and exposure management capabilities.

Requirements

Degree in Computer Science, Information Technology, or a related discipline.
3-5 years of hands-on cybersecurity experience, preferably within cybersecurity operations, attack surface/exposure management, third-party cyber risk assessment, or data lake environments.
Practical experience conducting third-party/vendor security assessments and questionnaires, including VDD, ODD, and SIG.
Good knowledge of cybersecurity frameworks such as NIST, ISO 27001, and CIS Controls.
Hands-on experience with ASM/EASM, cyber exposure management, digital risk monitoring, dark-web monitoring, and/or Cyber Threat Intelligence (CTI) platforms.
Strong scripting capabilities using Python, PowerShell, or Bash, particularly for automation and reporting.
Strong understanding of TCP/IP, DNS, HTTP/S, and common security exposures across AWS, Azure, and GCP.
Understanding of third- and fourth-party cyber risk and how security exposure can propagate through the supply chain.
Strong analytical and documentation skills, with the ability to handle sensitive security findings appropriately.
Good communication and stakeholder management skills across technical and business teams.
Collaborative, adaptable, and comfortable working in a fast-evolving cybersecurity environment.

Good to Have

Certifications such as Security+, CEH, GIAC (GSEC/GCIH), CompTIA CySA+, or equivalent.
CISSP Associate or CISM candidature.
Experience developing cyber posture scorecards and operational security dashboards.
Familiarity with detection engineering, including tuning detection logic and refining security control baselines as capabilities mature.

Detection Engineer EASM / ASM / Cyber Threat Intelligence (CTI)