Detection Engineer

## Join Us At Vodafone, we’re not just shaping the future of connectivity for our customers – we’re shaping the future for everyone who joins our team. When you work with us, you’re part of a global mission to connect people, solve complex challenges, and create a sustainable and more inclusive world. If you want to grow your career whilst finding the perfect balance between work and life, Vodafone offers the opportunities to help you belong and make a real impact. Cyber Defence Operations (CDO) is Vodafone Group’s Cyber Defence Operations Centre of Excellence. CDO’s mission is to protect Vodafone customers against global cyber risk. CDO is specifically accountable for delivering: * Cyber Defence operational leadership across Vodafone. * Cyber Defence operational capabilities to Vodafone Group, the Local Market Operating Companies, and Partner Markets to enhance Vodafone’s global cyber defence posture and reduce its cyber risk. The purpose of this role is to own the end‑to‑end strategy and operational assurance of threat relevant telemetry and adversary coverage to strengthen detection effectiveness across the CSOC. The role ensures that security telemetry is strategically onboarded, normalised, enriched and governed to support effective, scalable, adversary aligned detection and response across Vodafone’s environments. It strengthens CSOC maturity through a consistent, threat-led approach to telemetry strategy, coverage visibility and ingestion assurance. The role works closely with CSOC, Cyber Prevent platform teams and Local Markets to align data strategy, coverage intent, and operational outcomes, providing a strong foundation for detection engineering, threat hunting, and response. The Detection Engineer works within the Cyber Security Operations team and operates at the intersection of threat modelling, telemetry strategy, and detection coverage. This role is accountable for: * Defining what telemetry is required to detect adversary behaviour across Vodafone environments * Ensuring that ingested data is complete, timely, well‑structured, and fit for behavioural detection use cases * Providing transparent, ATT&CK‑aligned visibility of coverage gaps and data‑driven risk The role operates with minimal supervision and requires strong collaboration across Vodafone’s global cyber security community. ## What you’ll do * Own the threat‑led strategy for onboarding and prioritising security telemetry, ensuring data sources are aligned to MITRE ATT&CK coverage, threat modelling outputs and adversary behaviour relevant to Vodafone; * Own the definition of minimum viable logging requirements for CSOC, ensuring each critical platform (endpoint, identity, network, cloud, SaaS) provides the logs required to reliably observe adversary behaviour aligned to current threat models; * Determine which log sources are security‑critical versus informational, ensuring CSOC ingestion is intentional and prioritised based on detection value rather than volume; * Define and govern acceptance criteria for telemetry consumed by CSOC, including data quality, enrichment, completeness, and timeliness, ensuring logs are fit for adversary aligned detection; * Maintain ATT&CK‑aligned coverage views that demonstrate how telemetry sources map to adversary techniques, highlighting coverage gaps and their impact across platforms, environments, and Local Markets; * Provide clear, actionable insight into how telemetry quality and availability affect detection effectiveness, enabling Detection Engineering teams to build scalable behavioural detections; * Produce and maintain assurance artefacts (e.g. ATT&CK overlays, dashboards, runbooks) that demonstrate logging and monitoring effectiveness to Cyber Defence leadership, audit, and Local Market stakeholders; * Act as the named authority for visibility and telemetry‑related risk, including documenting coverage gaps, authorising risk acceptance where required, and tracking remediation; *...