Security Content Engineer

• Enrich security signals to improve SOC efficiency and outcomes
• Research threat actors and attack vectors to develop detection content for emerging threats
• Design and build automation content for onboarding new products
• Assist clients in testing and tuning detection logic to reduce false positives and alert fatigue
• Identify and promote reusable content (rules, automations, dashboards) across clients
• Collaborate with integration teams to optimize log ingestion and reduce noise
• Deliver research-driven content such as queries, signatures, rules, and knowledge base articles
• Develop supplemental detection coverage for high-risk vulnerabilities and exploits
• Contribute to the evolution of security policies, procedures, and automation frameworks
• Communicate regularly with client IT teams to provide guidance and ensure operational readiness
• Support the development of incident response processes and documentation
• Assist with advancing security standard operating procedures and incident response reporting.

• Strong collaboration and interpersonal skills, especially in distributed team environments
• Excellent written and verbal communication skills; ability to explain complex topics clearly
• Experience in writing detection signatures or algorithms
• Proficiency in analyzing event logs and identifying indicators of compromise
• Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools
• Familiarity with:
  • Sentinel Incidents, Workbooks, Hunting Queries, Notebooks
  • Kusto Query Language (KQL) or similar
  • Complex JSON structures
  • Development tools (Git, IDEs, CI/CD pipelines)Strong scripting skills (Python, Ruby, etc.)
• Experience in digital forensics and blue team operations
• Solid understanding of network protocols and infrastructure
• Ability to gather client requirements and translate them into technical solutions
• Deep knowledge of:
  • SIEM/SOAR platforms
  • API integrations
  • Endpoint Detection and Response (EDR)
  • Log analysis and malware detection
  • Network monitoring tools
  • Case management systems
  • Atlassian Suite (Jira, Confluence)
  • Email security, DLP, encryption, and vulnerability management

• Background in intrusion analysis, detection engineering, or penetration testing
• 5+ years of experience in IT or cybersecurity, with a focus on SIEM and detection content
• Relevant certifications such as Microsoft 365 Certified: Security Administrator Associate, GCFA, GCFE, or OSCP

• Bachelor's degree in a related field or equivalent professional experience and certifications

BlueVoyant Candidate Privacy Notice

To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice