Threat Detection Engineer

Nordic Investin Group • Stockholm, ME

19h

About The Position

Nordic Investin is recruiting a Threat Detection Engineer for a partner company strengthening its capability in high-quality detection content grounded in realistic attack behaviour. The role connects SIEM engineering, detection rules and telemetry, while bringing discipline to threat mapping and testing. The goal is to make practical progress that colleagues can use, leaders can evaluate and the organisation can sustain.

The engineer will work with product, architecture, security, operations and domain colleagues. The environment values short feedback loops, evidence from real systems and direct communication, with security and operability considered in design. The role calls for solid delivery experience and broader ownership: making trade-offs visible, seeking wider expertise when needed and moving work forward without unnecessary process.

The opportunity offers meaningful ownership and influence over the solution, decisions, priorities and success measures. The exact partner, employment model, compensation, start date and working arrangement will be explained during the recruitment process.

Requirements

• Relevant experience delivering high-quality detection content grounded in realistic attack behaviour in a demanding environment.
• Strong working knowledge of SIEM engineering and detection rules.
• Practical experience applying telemetry and threat mapping.
• Ability to assess priorities, risks and trade-offs involving testing.
• Evidence of clear stakeholder communication and dependable end-to-end ownership.
• Professional English and the judgement to work with sensitive or business-critical information.
• Solid delivery experience and the appetite to take broader ownership.

Nice To Haves

• Experience from enterprise security operations and cloud environments.
• Exposure to incident feedback in a cross-functional or multi-team environment.
• Swedish language skills or experience working across Nordic organisations.
• A background in product engineering, platform work, enterprise technology or consulting, with technical depth connected to user and business consequences.
• Adjacent experience demonstrating transferable judgement.

Responsibilities

• Own the practical direction for high-quality detection content grounded in realistic attack behaviour.
• Translate goals and constraints into a clear approach for SIEM engineering and detection rules.
• Establish useful standards, routines or decision artefacts around telemetry.
• Coordinate stakeholders and dependencies affecting threat mapping.
• Use evidence and measurable outcomes to improve testing.
• Strengthen knowledge sharing and sustainable ownership through incident feedback.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed