Security Detection Engineer

About this job

WPP is hiring a Security Detection Engineer for its team in Chennai, India. WPP serves as a trusted growth partner for leading global brands, combining media intelligence, data solutions, creativity, production, and enterprise solutions powered by the WPP Open platform. The Detection Engineering team is responsible for designing, developing, and maintaining high-fidelity detection logic across enterprise security platforms, supporting the transition toward an Autonomic Security Operations model. On a typical day, you will build and test detection rules across SIEM, EDR, NDR, and cloud platforms, automate rule deployment using CI/CD pipelines, conduct root cause analysis on missed detections, manage continuous security improvement backlogs, and collaborate closely with SOC, incident response, and threat hunting teams to integrate emerging threats and validate logic against simulated attack paths.

Responsibilities

• Develop, test, and maintain detection rules across SIEM, EDR, NDR, and cloud platforms.
• Automate detection rule deployment, quality assurance, and version control using scripting and CI/CD pipelines.
• Conduct root cause analysis on missed detections and high-severity incidents to drive corrective actions.
• Manage a continuous security improvement backlog focusing on detection gaps and false positive reduction.
• Collaborate with SOC, incident response, and threat hunting teams to operationalize detection improvements.
• Integrate emerging TTPs from threat intelligence teams into detection logic.
• Contribute to purple team exercises by validating detection logic against simulated attack paths.

Requirements

• Strong knowledge of SIEM, SOAR, EDR, and cloud security platforms.
• Proficiency in scripting and automation using Python or PowerShell.
• Familiarity with detection-as-code principles and CI/CD pipelines.
• Understanding of the MITRE ATT&CK framework and threat-informed defense.
• Ability to work closely with SOC analysts, threat hunters, and engineers.
• Skilled in documenting detection logic and root cause analysis outcomes.

Good to have

• GIAC GCTI certification
• GCFA certification
• Equivalent advanced security certifications

Who should apply

This role suits candidates with a strong technical background in security detection engineering, automation, and threat-informed defense who enjoy working in collaborative, inclusive environments. Applicants should possess solid scripting skills in Python or PowerShell, hands-on experience with SIEM and EDR platforms, and an automation-first mindset. The job posting does not mention whether freshers can apply, so experienced security professionals meeting the technical requirements are encouraged to apply.

Frequently asked questions