Threat Detection Engineer

Threat Detection Engineer – Drive Cutting-Edge Cybersecurity Solutions at COGNNA

Are you a cybersecurity professional with a passion for innovation, threat intelligence, and operational excellence? COGNNA is seeking a highly skilled Threat Detection Engineer to design, implement, and optimize world-class detection strategies that fortify our Security Operations Center (SOC) against evolving cyber threats. In this dynamic role, you will collaborate with cross-functional teams to enhance threat detection capabilities, automate workflows, and elevate SOC maturity while mentoring emerging cybersecurity talent.

As a Threat Detection Engineer at COGNNA, you will play a pivotal role in shaping our security posture by leveraging advanced threat intelligence, adversary tactics, and cutting-edge technologies. Your expertise will drive the development of high-fidelity detection rules, behavioral analytics, and automated responses that proactively identify and mitigate threats before they escalate. This is more than a job—it’s an opportunity to make a tangible impact on global cybersecurity defenses while contributing to a culture of innovation and continuous improvement.

Key Responsibilities

Your responsibilities will span across multiple critical domains, ensuring our SOC operates at peak efficiency and resilience:

• Advanced Threat Detection Engineering: Design and deploy sophisticated detection strategies within COGNNA’s security platforms, translating complex threat intelligence—including MITRE ATT&CK frameworks, adversary TTPs, and vulnerability data—into actionable detection logic. Continuously refine and expand detection capabilities to address emerging threats, identify gaps, and integrate new data sources to strengthen our defense mechanisms.
• Detection Automation and Quality Assurance: Develop and maintain automated testing frameworks to validate detection efficacy, ensuring high-fidelity alerts and minimizing false positives. Leverage your expertise in scripting and automation to enhance detection quality and operational efficiency over time.
• Platform Engineering and Optimization: Lead the architecture and optimization of our XDR, SIEM, and SOC technology stacks, focusing on scalability, performance, and resilience. Streamline log ingestion pipelines, from parsing and normalization to enrichment, to ensure seamless data flow and actionable insights. Build and integrate custom scripts (Python, PowerShell) to automate repetitive tasks and enhance SOC workflows.
• Threat Hunting and Incident Response: Collaborate closely with threat intelligence and incident response teams to enrich detection use cases, support proactive threat hunting initiatives, and provide expert-level Tier-3+ support during incident investigations. Contribute to post-mortem analyses to refine detection strategies and prevent future breaches.
• SOC Maturity and Compliance: Drive improvements in SOC playbooks, standard operating procedures (SOPs), and detection engineering workflows. Stay ahead of global and regional threat landscapes, ensuring our detection strategies evolve in tandem with adversary tactics. Align detection frameworks with regulatory standards, including NCA ECC and SAMA CSF, to maintain compliance and operational excellence.

Why Join COGNNA?

At COGNNA, we empower our talent to make a meaningful difference in the cybersecurity landscape. This role offers:

• Impact That Matters: Shape the future of cybersecurity by developing solutions that protect organizations worldwide. Your work will directly contribute to reducing cyber risks and enhancing global digital resilience.
• Collaborative Innovation: Work in our state-of-the-art Almadina office alongside a team of passionate cybersecurity experts. Engage in dynamic discussions, share insights, and collaborate on projects that push the boundaries of threat detection and response.
• Career Growth and Development: Access a comprehensive suite of certifications, training programs, and mentorship opportunities designed to help you advance your expertise. COGNNA invests in your professional growth, ensuring you remain at the forefront of cybersecurity trends.
• Ownership and Recognition: Benefit from our Employee Stock Ownership Program (ESOP), aligning your success with COGNNA’s growth. Your contributions will be recognized, rewarded, and celebrated in a culture that values ownership and accountability.
• Culture of Trust and Excellence: Join a team that fosters trust, encourages innovation, and celebrates real outcomes. Your ideas will be heard, your efforts will be supported, and your achievements will be acknowledged in a collaborative and inclusive environment.

Qualifications and Skills

To excel in this role, you will bring a blend of technical expertise, analytical rigor, and a proactive mindset:

• Education: Bachelor’s degree in Computer Science, Cybersecurity, or a related field. Advanced degrees or certifications are a significant advantage.
• Experience: Hands-on experience in developing, maintaining, and optimizing complex detection use cases. Deep understanding of attacker behavior, incident response fundamentals, and digital forensics. Proven ability to analyze and interpret threat intelligence to inform detection strategies.
• Technical Proficiency:
• SIEM: Expertise in querying SIEM platforms using SPL, KQL, and Lucene. Proficient in rule tuning, User and Entity Behavior Analytics (UEBA), and scaling detection frameworks for large-scale environments.
• EDR: Deep knowledge of Endpoint Detection and Response (EDR) tools, including endpoint detection tactics, behavioral analysis, and threat hunting techniques.
• Network Security: Skilled in packet analysis (Wireshark), Intrusion Detection/Prevention Systems (IDS/IPS), and NetFlow monitoring. Ability to analyze network traffic for anomalies and threats.
• Scripting: Advanced proficiency in Python and/or PowerShell for automation, integration, and custom tool development.
• Operating Systems: Mastery of Windows, Linux, and macOS logging mechanisms, artifacts, and forensic techniques to extract actionable threat indicators.
• Threat Intelligence: Ability to translate raw threat intelligence into real-time detection logic, leveraging frameworks like MITRE ATT&CK and STIX/TAXII.
• Cloud Security: Strong command of monitoring and securing IaaS, PaaS, and SaaS environments, including cloud-native threat detection and response.
• Certifications (Preferred): SANS GIAC certifications (e.g., GDAT, GMON, GCIA, GCTI, GCIH), Offsec (OSDA), INE (eCTHP, eCIR), or (ISC)² certifications such as CISSP or CSSLP.
• Soft Skills: Exceptional analytical thinking and creative problem-solving to tackle complex cybersecurity challenges. Excellent communication skills in both English and Arabic, with the ability to produce clear, concise, and technically accurate reports. Strong mentorship abilities and a collaborative spirit to guide and uplift junior team members. Self-motivated, resilient, and passionate about cyber defense, with the ability to thrive in high-pressure environments and manage multiple priorities effectively.

If you are a visionary threat detection engineer eager to make a lasting impact in cybersecurity, we invite you to join COGNNA and be part of a team that is redefining the future of digital security.