Own escalated security incidents end-to-end, including scoping, evidence collection, threat analysis, containment, and remediation
Analyze and reverse engineer malware to understand its behavior, extract Indicators of Compromise (IOCs), identify Tactics, Techniques, and Procedures (TTPs), and determine appropriate detection and response
Conduct threat hunting using existing detection content, threat intelligence, and independent hypothesis-driven analysis
Review and provide feedback on reported security incidents

Detection Engineering

Write, test, and deploy detection rules (YARA-L or equivalent) through the team's CI/CD Detection-as-Code pipeline
Tune existing detections to reduce false positives, using incident and hunting findings as the primary signal for what needs fixing
Identify detection gaps surfaced during investigations and translate them into new rule proposals
Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows, to automate alert triage, enrich investigations, and speed up incident response.
Participate in tabletop, purple-team, and threat-intel-driven simulation exercises, including scenario execution and converting findings into new detections
Translate relevant threat intelligence into new detection opportunities or hunting hypotheses

Collaboration & Documentation

Work cross-functionally with cloud security, infrastructure, and development teams to close systemic gaps identified during investigations
Maintain accurate records for incidents, detection changes, and threat intelligence, and keep the playbook library current
Document new detection logic and rule changes to a standard that supports peer review and audit

Compliance & Continuous Improvement

Ensure IR and detection engineering practices align with PCI-DSS, ISO 27001, and NIST CSF 2.0
Stay current with cybersecurity trends and threat landscape shifts, and proactively implement IR or detection process improvements

Log Integration, Visibility, & Threat Modeling

Drive log source onboarding and ingestion health across enterprise applications and cloud environments; identify critical visibility gaps; and coordinate remediation with relevant teams.
Lead threat modeling exercises for critical infrastructure and translate findings into high-fidelity detection rules and proactive threat hunting hypotheses
Implement and maintain automated event enrichment pipelines to enhance context for security investigations and improve analyst efficiency.

Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent hands-on experience)
2 - 4 years of experience in incident response, SOC operations, or detection engineering
Demonstrated experience writing or tuning detection rules in a SIEM (Google SecOps, or similar), using a rule language such as YARA-L, CQL, KQL, or Sigma
Solid experience with SIEM and EDR platforms, log analysis, and end-to-end incident triage/investigation
Working knowledge of MITRE ATT&CK and how it maps to detection coverage
Comfortable with Python, JavaScript, or a similar scripting language for automation and detection support work
Strong written communication skills for incident reports and detection documentation

Preferred Skills & Certifications

Experience with SOAR platforms or building automation for triage/enrichment
Exposure to multi-cloud environments (GCP, AWS) and fintech/financial-sector threats
Foundational digital forensics or malware analysis experience
GCIH, CySA+, or equivalent IR/detection engineering certifications

Recruit better talent faster - on your own or with our support.

Job search tips from Fuzu

Selected articles on cover letters, CV structure, and interview preparation.

Information technology, software development, data Jobs in Nigeria