Detection Engineer

Job summary

This is an exciting opportunity to work at the heart of Government cyber security, as part of the Government Cyber Coordination Centre (GC3). The GC3 is a joint initiative sponsored by the Government Digital Service (GDS) and the National Cyber Security Centre (NCSC). The GC3 coordinates the cross-Government response to cyber security vulnerabilities, threats, and incidents, enhancing cyber resilience and enabling the Government to more efficiently and effectively protect public services and “defend as one”.

In June 2025, the Government Cyber Unit moved from the Cabinet Office to the Department for Science, Innovation and Technology (DSIT) as part of a machinery of government (MoG) change. This role is in scope to transfer to DSIT in February 2026. We are currently consulting with Trade Unions on which policies, terms and conditions will apply on transfer. The statement of changes applied to all other Cabinet Office staff will also apply to you if you are successful.

Job description

Design, implement, and optimize threat detection content across a wide range of platforms and data sources. This role combines advanced query language skills, a deep understanding of system and network logging, and experience with rule-based detection engines and CI/CD pipelines (notably those developed in Python).

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is Security Check (SC) but must be willing to undergo Developed Vetting (DV) clearance whilst in post where necessary.

Key Responsibilities

• Develop and optimize detection rules using query languages such as:
  o KQL (Microsoft Sentinel / Defender XDR)
  o SPL (Splunk)
  o AQL (QRadar)
  o EQL/Lucene (Elastic Security)
  o SQL (across traditional and security data platforms
• Create and manage detection rules using cross-platform languages such as Sigma and YARA
• Build, test, and deploy detection rules using CI/CD tools and principles (e.g., GitHub Actions, GitLab CI, Azure DevOps)
• Tune and validate alerting logic to reduce false positives and optimize signal-to-noise ratio
• Contribute to detection-as-code practices with structured rule repositories (e.g., Sigma, Panther, custom JSON/YAML formats)
• Support threat hunting and incident triage using advanced log queries and packet inspection
• Collaborate with offensive security and threat intelligence teams to translate TTPs into behavioural detections, aligned with industry frameworks such as MITRE ATT&CK

Person specification

Essential Criteria

• Significant experience developing detection content in multiple detection query languages including:
  o KQL (Microsoft Sentinel / Defender XDR)
  o SPL (Splunk)
  o AQL (QRadar)
  o EQL/Lucene (Elastic Security)
  o SQL (across traditional and security data platforms)
• Strong understanding of endpoint and server logging, including: process execution, file activity, registry access/changes (Windows), network connections, and errors/system logs across OSes.
• Experience using cross-platform detection languages such as Sigma.
• Experience using Python.
• Experience building or using pipelines for detection deployment and validation in CI/CD environments, with version control (Git), YAML/JSON templating, and automated testing of detection rules.

Desirable Skills

• Experience developing transformers and wider infrastructure to support Sigma.
• Experience using OSquery or other endpoint telemetry frameworks.
• Experience with cloud-native logging (e.g., AWS CloudWatch, Azure Monitor).
• Experience performing malware analysis and/or reverse engineering.
• Experience using GraphQL or REST APIs for telemetry and enrichment.

Additional information:

A minimum 60% of your working time should be spent at your principal workplace. Although requirements to attend other locations for official business will also count towards this level of attendance.

Behaviours

We'll assess you against these behaviours during the selection process:

• Seeing the Big Picture
• Communicating and Influencing
• Managing a Quality Service
• Delivering at Pace

Technical skills

We'll assess you against these technical skills during the selection process:

• Foundational networking knowledge
• Foundational SOC knowledge
• Splunk SPL Skills
• Investigating Malicious Activity

Benefits

Alongside your salary of £47,670, Cabinet Office contributes £13,809 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

• Learning and development tailored to your role.
• An environment with flexible working options.
• A culture encouraging inclusion and diversity.
• A Civil Service Pension which provides an attractive pension, benefits for dependants and employer contributions of 28.97%.
• A minimum of 25 days of paid annual leave, increasing by one day per year up to a maximum of 30.

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

Application process

As part of your application, you will be required to provide a CV setting out your career history/qualifications/previous skills and experience, highlighting specific responsibilities and achievements that are relevant to the essential criteria in the person specification section of the job advert.

You will also be required to provide a personal statement of 750 words.

Your Personal Statement will be assessed against the essential criteria listed in the 'Person Specification' section of the job advert.

Interview Process

Should you be successful at sift, you will be invited to attend an interview.

There will be 2 interview rounds:

1. First round - The first round will be a shorter interview assessing your experience only.
2. Final round - The final round of interviews will assess your experience in more depth, as well as behaviours and technical skills as listed in the advert. Further details will be released for candidates successful at interview 1.

Please note - You must pass the first round of interviews to progress to the final round.

Your interview will either be conducted face to face or by video. You will be notified of the location if you are selected for interview.

Sift and interview dates to be confirmed.

Further Information

A reserve list may be held for a period of 12 months from which further appointments can be made.

Any move to Cabinet Office from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare; for further information visit the Childcare Choices website.

If successful and transferring from another Government Department a criminal record check may be carried out.

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf.

However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

For further information on National Security Vetting please visit the Demystifying Vetting website.

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.

A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.

This role is full time only. Applicants who wish to work an alternative pattern are welcome to apply however your preferred working pattern may not be available and you should discuss this with the vacancy holder before applying.

Please note that this role requires SC clearance, which would normally need 5 years’ UK residency in the past 5 years. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period. This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible.

Please note terms and conditions are attached. Please take time to read the document to determine how these may affect you.

Reasonable Adjustment

If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

Contact Government Recruitment Service via menurecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.

Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : Rob Lowery
• Email : rob.lowery@digital.cabinet-office.gov.uk

Recruitment team

• Email : menurecruitment.grs@cabinetoffice.gov.uk

Further information

Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles.
If you feel that your application has not been treated in accordance with the Recruitment Principles, and wish to make a complaint, then in the first instance you should contact Government Recruitment Service at: menurecruitment.grs@cabinetoffice.gov.uk.
If you are not satisfied with the response that you receive, then you can contact the Civil Service Commission at: info@csc.gov.uk.
For further information on the Recruitment Principles, and bringing a complaint to the Civil Service Commission, please visit their website at: https://civilservicecommission.independent.gov.uk.

Attachments

Cabinet Office Employee Offer Opens in new window (pdf, 302kB)Cabinet Office Terms and Conditions - External 2025-02-20 Opens in new window (docx, 83kB)