Security Detection Engineering Lead

WPP is the trusted growth partner for the world’s leading brands.

We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.

We have been building the world's most valuable brands for 50 years and have global reach across 100+ markets, with deep local expertise.

Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.

For more information, visit WPP.com.

Why we're hiring:

The Detection Engineering Lead is responsible for managing and mentoring detection engineers, driving the development and optimization of detection logic, and ensuring alignment with SOC transformation goals. This role combines technical depth with leadership, focusing on automation-first practices and continuous improvement of detection coverage and fidelity.

What you'll be doing:

Detection Engineering Leadership

• Lead and mentor detection engineers, fostering innovation and continuous learning.
• Oversee design, development, and deployment of detection logic across SIEM, EDR, NDR, and cloud-native platforms.
• Implement detection-as-code lifecycle (CI/CD pipelines, version control, automated QA).
• Maintain detection performance dashboards and KPIs (true/false positive rates, missed detections, alert-to-response time).
  
  

Cross-Team Collaboration

• Work closely with Threat Intelligence, Incident Response, and Threat Hunting teams to operationalize detection improvements.
• Translate post-incident findings into detection enhancements and automation opportunities.
• Support purple team exercises to validate detection logic against adversary TTPs.
• Continuous Security Improvement (CSI)
• Maintain a backlog of detection gaps, telemetry blind spots, and false positives for remediation.
• Drive initiatives to improve detection coverage and efficiency using automation and analytics.
• Align detection priorities with business risk and SOC transformation roadmap.
  
  

Strategic Alignment to GCAT SOC10x

• 10X People: Build team capability through training and knowledge sharing.
• 10X Process: Embed agile workflows and automation-first principles.
• 10X Technology: Leverage AI/ML for detection tuning and anomaly detection.
• 10X Visibility: Ensure comprehensive telemetry ingestion and observability.
• 10X Speed: Reduce detection-to-response cycle through orchestration and automation.
  
  

What you'll need:

Technical Expertise

• Strong knowledge of SIEM, SOAR, EDR, and cloud security platforms.
• Proficiency in scripting and automation (Python, PowerShell).
• Experience with detection-as-code, CI/CD pipelines, and QA automation.
• Familiarity with MITRE ATT&CK, threat intelligence integration, and behavioral analytics.
  
  

Leadership & Collaboration

• Proven experience managing detection engineering teams in enterprise SOC environments.
• Ability to prioritize detection initiatives based on risk and operational impact.
• Skilled in cross-functional collaboration with IR, Threat Hunting, and DevOps teams.
  
  

Certifications (Preferred)

• GIAC GCTI, GCFA, or equivalent advanced security certifications.
  
  

Key Attributes

• Automation-first mindset with focus on scalability and resilience.
• Strong analytical and problem-solving skills.
• Excellent communication and leadership capabilities.
  
  

Who you are:

You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.

You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.

You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.

What we'll give you:

Passionate, inspired people – We aim to create a culture in which people can do extraordinary work.

Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.

Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?

We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.

WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.

Please read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.