Sr Detection Engineer II

About the Company

Responsibilities

• ● Job Description
• ● Jeppesen Foreflight is one of the largest software development companies in Gothenburg. We develop and implement advanced Crew and Operations Management solutions used by several of the world's leading airlines. From smarter crew scheduling to better aircraft utilization, our software systems make a real impact on global travel.
• ● At Jeppesen's office in central Gothenburg you will work in a one-of-a-kind software development organization with solutions that make a real difference to people around the world. You will be working in an agile learning organization, surrounded by a team of talented, creative and dedicated colleagues. You will learn and broaden your perspective by working with 400 professionals from more than 50 different nations but also be part of a global organization allowing for collaboration with customers and colleagues across the world. Most importantly, you will be expected to make a difference.
• ● Senior Security Detection & Automation Engineer
• ● This role focuses on designing high-quality security detections, building scalable automation, integrating security technologies, and improving the efficiency and effectiveness of security monitoring. This is an core security position, not a Tier 1 or Tier 2 alert-monitoring role.
• ● Detection Engineering
• ● Design, develop, test, deploy, and maintain security detections across endpoint, identity, cloud, network, email, and application environments.
• ● Translate threat intelligence, attacker behaviors, threat-hunting findings, and security risks into actionable detection logic.
• ● Develop behavioral, anomaly-based, and correlation-based detections across multiple data sources.
• ● Create detection content using Sigma, KQL, SPL, YARA, Suricata, or platform-specific query languages.
• ● Map detection coverage to MITRE ATT&CK and identify gaps across priority attack techniques and critical assets.
• ● Tune detections to improve fidelity, reduce false positives, and minimize unnecessary analyst workload.
• ● Define detection requirements, including data dependencies, logic, severity, confidence, response guidance, and ownership.
• ● Manage the complete detection lifecycle, from initial development through validation, deployment, maintenance, and retirement.
• ● Measure detection quality through coverage, precision, alert volume, false-positive rates, and detection performance.
• ● Security Automation
• ● Design and develop automation for alert enrichment, correlation, prioritization, evidence collection, case creation, and analyst recommendations.
• ● Automate repetitive Tier 1 and Tier 2 activities to improve analyst capacity and consistency.
• ● Build integrations between SIEM, EDR, XDR, SOAR, identity, cloud, threat intelligence, vulnerability management, ticketing, and communication platforms.