Threat detection engineers who know what identity attacks look like.
Demand Cyber places identity threat detection engineers, Active Directory security specialists and detection engineers who build detections around identity: sign-ins, privilege changes and token misuse. Each one is tested hands-on by a CISSP-certified practitioner.
What is identity-aware threat detection?
It means building detections on identity signals, such as unusual sign-ins, new privileged role assignments and suspicious token use, alongside endpoint and network data. An attacker using valid credentials can look normal to tools that only watch endpoints.
What does an identity-based attack look like?
Many follow a similar path: stolen credentials, a way past multi-factor authentication, more privilege, then persistence and data access. Each step leaves an identity signal a detection engineer can catch.
Which detection platforms do you cover?
Identity threat platforms such as Microsoft Defender for Identity, CrowdStrike Falcon Identity and Semperis, plus the SIEMs your detections run on, mainly Microsoft Sentinel and Splunk. Candidates write and tune real detections on your platform in the sandbox.
| Platform | Skills we test in the sandbox |
|---|---|
| Microsoft Defender for Identity | Sensor deployment, identity alerts, lateral movement paths |
| CrowdStrike Falcon Identity | Identity protection policies and just-in-time access |
| Semperis | Active Directory change auditing, resilience and forest recovery |
| Silverfort | Protection for service accounts and legacy authentication |
| Microsoft Sentinel | KQL analytics rules, hunting queries and automation playbooks |
| Splunk (Cisco) | SPL correlation searches, data onboarding and MITRE ATT&CK mapping |
| And More | Ask us about platforms not listed here. |
How do you test Active Directory security skills?
With common attack paths: Kerberoasting, DCSync and delegation abuse, plus Entra ID token theft and consent phishing. Candidates find and close them in a sandbox domain.
Which threat detection roles can you fill?
Engineers who build identity detections and harden Active Directory, plus the SIEM engineers whose platforms the detections run on.
How do you vet threat detection specialists?
Every threat detection specialist we put forward has passed four screening stages run by CISSP-certified practitioners. In the sandbox stage, they write and tune detections against synthetic test data.
Of everyone we source, 42% pass the credential and background check, 18% pass the sandbox deep-dive, 6% pass the practitioner panel and about 1% are cleared for placement. See how we vet or view a sample candidate report.
Can I hire identity threat and detection engineers on contract or permanently?
Both. Many contractors are available within one to two weeks of the scoping call, which suits an Active Directory hardening or identity threat project.
Permanent hires are fee-based, with a replacement guarantee. Contract Placement · Permanent Hire · Advisory & Workshops
Common questions.
Do you offer managed detection and response?+
Yes. We also place engineers and analysts to run detection in your own SOC or with your current provider.
Can you help recover Active Directory after an attack?+
We place AD security and Tier 0 engineers who work with recovery tools such as Semperis and Quest Recovery Manager. Many are available within one to two weeks of the scoping call.
Which query languages do you test?+
KQL for Microsoft Sentinel and Defender, and SPL for Splunk, on synthetic test data in the sandbox.
What if I don't have the budget for an onshore resource?+
Our Global & Blended Teams option pairs an onshore lead with vetted engineers in our talent hubs in the Philippines, Vietnam and Singapore. You keep a local point of contact at a lower blended day rate, and every engineer passes the same practitioner vetting. See Global & Blended Teams
Need a threat detection specialist?
Book a 30-minute scoping call. You'll speak to a practitioner, not a recruiter.