Threat Detection Engineer

Nordic Investin has been asked to find a Threat Detection Engineer for one of our partner companies. You want technical choices, delivery and production behaviour to reinforce each other, even when the constraints are difficult. The partner is strengthening its capability in high-quality detection content grounded in realistic attack behaviour. You will connect SIEM engineering, detection rules and telemetry while ensuring that threat mapping and testing receive appropriate discipline. The aim is practical progress that colleagues can use, leaders can evaluate and the organisation can sustain. The environment rewards early questions, visible trade-offs and engineering discipline. Security and operability belong in the design. How you will work You will work with product, architecture, security, operations and domain colleagues. The partner values short feedback loops, evidence from real systems and direct communication. This role calls for solid delivery experience and the appetite to take broader ownership. You are expected to make trade-offs visible, recognise when a decision needs wider expertise and move work forward without creating unnecessary process. What you will do Own the practical direction for high-quality detection content grounded in realistic attack behaviour. Translate goals and constraints into a clear approach for SIEM engineering and detection rules. Establish useful standards, routines or decision artefacts around telemetry. Coordinate stakeholders and dependencies affecting threat mapping. Use evidence and measurable outcomes to improve testing. Strengthen knowledge sharing and sustainable ownership through incident feedback. What you will bring Relevant experience delivering high-quality detection content grounded in realistic attack behaviour in a demanding environment. Strong working knowledge of SIEM engineering and detection rules. Practical experience applying telemetry and threat mapping. Ability to assess priorities, risks and trade-off