Detection Engineer

Reapit is the original end-to-end business technology provider for estate agencies of all sizes. We've been helping sales and lettings agents build relationships and grow their businesses for more than 25 years. Our technology empowers property professionals across Europe, the Middle East, Australia, and New Zealand to work with buyers, sellers, tenants, and landlords to deliver a dream home experience.

Worldwide, over 78,000 agents across more than 15,000 branches use Reapit to run their businesses, manage properties, collect rent, engage clients, and provide outstanding customer service every time.

What you'll be doing

Reporting to the CISO and working collaboratively with the Security Team, you'll take ownership of our cloud-native detection and response capability. You'll design and implement advanced security detections across AWS/Azure environments and our products, partnering with our external SOC to ensure threats are identified and responded to rapidly. Your work will be hands-on and technical, focusing on reducing our organisation's exposure to compromise through effective threat modelling, detection rule development, and incident response automation.

Key Responsibilities

• Design and implement detection rules and alerts across Elastic and Azure Sentinel SIEM platforms

• Develop and refine threat models to identify attack vectors and potential security gaps in AWS/Azure environments and our products

• Create security playbooks for incident response, including automated and manual response procedures

• Build automated responses with the Security team

• Collaborate with the external SOC team to optimise detection strategies and ensure effective threat identification

• Perform threat hunting and analysis to identify anomalies and emerging security threats

• Tune and optimise detection rules to reduce false positives whilst maintaining detection accuracy

• Document detection logic, alert thresholds, and playbook procedures for knowledge transfer and compliance

• Build the playbooks with the Security team

Desirable Skills & Experience

• Experience with security orchestration, automation, and response (SOAR) platforms

• Knowledge of log management, data ingestion, and normalisation

• Familiarity with PowerShell scripting or Python for detection automation

• Experience with cloud-native security tools (CloudTrail, Security hub, guard duty etc.)

• Relevant security certifications (GIAC, ECIH, CEH, CISSP, or similar)

• Prior experience working with managed security service providers or external SOCs

Technical Environment

You will work with:

• Cloud Platforms: AWS (CloudTrail, VPC Flow Logs, GuardDuty) and Azure (Activity Logs, Network Watchers)

• SIEM Tools: Elastic Stack and Azure Sentinel

• Query Languages: KQL, EQL, and similar detection rule languages

• Collaboration Tools: Integration with external SOC platforms and ticketing systems

Who we're looking for

At Reapit, we prioritise hiring individuals who share our values and possess the right attitudes and behaviours for success. Whilst some of the listed requirements may be important, don't worry if you don't meet all of them, we'd still like to hear from you.

• 5+ years of experience in security operations, threat detection, or SOC operations

• Demonstrated expertise in Elastic Stack (Elasticsearch, Kibana) and/or Azure Sentinel

• Strong understanding of cloud security, including AWS and Azure security posture and compliance

• Hands-on experience writing detection rules using KQL (Kusto Query Language) and/or EQL (Event Query Language)

• Using automation tools such as tines, Shuffler, Tracecat.

• Proficiency in threat modelling frameworks (MITRE ATT&CK, Cyber Kill Chain, or similar)

• Experience creating security playbooks and incident response procedures

• Understanding of offensive security techniques and common attack patterns

• Excellent communication skills with ability to work effectively with technical and non-technical stakeholders

• Ability to work independently and manage multiple projects simultaneously

What your impact and success looks like

As a Detection Engineer, we expect your success and impact in the early stages of your employment with us to look something like this:

1 Month Goals

• Onboarding completion and SOC team integration

• Understanding existing detections and cloud architecture

• Baseline threat landscape assessment

• Quick wins identified

3 Month Goals

• new/improved detection rules deployed

• security playbooks are in flow of being created created/refined

• Reduced false positive rates

• Threat hunting demonstrations

• Clear communication protocols established with SOC

• Comprehensive documentation delivered

6 Month Goals

• Robust detection and automation programme covering major attack vectors

• detection rules/playbooks deployed

• Significant improvements in alert accuracy

• Comprehensive threat modelling exercises completed

• Complete documentation and knowledge base created

• Measurable value documented (threats detected, incidents responded to, risk mitigated)

• Handover complete to the Security team with full documentation

What's in it for you?

Don't tick all the boxes? Neither do we

We care about our industry and want it to become a more inclusive and diverse place to work. So, we're driven by hiring not only by experience and relevance for the role but by sharing our values and the right attitudes and behaviours for success.

We are committed to Equal Employment Opportunity through attracting and retaining a complementary team of employees and building an inclusive environment for all.

We feel we have an empowering environment where everyone is supported and respected, and we want you to feel this too. We welcome new ideas, thinking and approaches, whilst listening to all our employees.