Detection and Response Engineer

Location: Cambridge, UK – This position offers flexible working options, including predominantly remote work. Applicants should be based within a comfortable commuting distance of our office to attend onsite as required.

Are you experienced in detection and incident response, with an engineering mindset and a passion for improving the tools, automation and processes used to investigate threats?

As a Senior Detection & Response Engineer within our Cyber Security team, you’ll play a key role in strengthening Jagex’s detection and incident response capability across our studio and gaming environments. You’ll take ownership of escalated security investigations, going beyond routine alert handling to understand what happened, determine impact, and drive an effective response.

Alongside hands-on investigation, you’ll develop the tooling, detection logic, automation, runbooks and processes that enable us to identify and respond to threats more effectively. Working across a hybrid environment and alongside our external security operations capability, you’ll help ensure our monitoring and detection strategy focuses on the signals and risks that matter most.

What you’ll be doing:

• Lead investigations into escalated security events and incidents, developing hypotheses, collecting evidence and determining root cause and impact.
• Build and optimise detection rules, queries and monitoring logic across cloud, endpoint, network and application environments.
• Develop tooling and automation to improve security telemetry, alert enrichment, investigation workflows and response times.
• Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections.
• Create and continuously improve incident runbooks, playbooks and detection processes based on findings from real-world investigations.
• Work with our external SOC and internal engineering teams to strengthen monitoring coverage, investigate escalations and continuously improve our detection and response capability.
• This position will require participation in an on-call rotation.

What we’re looking for:

• Hands-on experience investigating security incidents, including developing investigation hypotheses, collecting artefacts and analysing endpoint, network and application data.
• Strong working knowledge of SIEM and security monitoring tooling, including the ability to write and develop queries for complex investigations.
• Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles.
• Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid infrastructure.