Security Content Engineer, BlueVoyant

• This role is ideal for a seasoned professional who consistently delivers high-quality work with minimal supervision
• 5-8 years of direct experience in Detection Engineering, Security Operations, or a similar role with a heavy focus on content creation
• Deep, hands-on expertise with the Microsoft security stack, including Microsoft Sentinel, Microsoft 365 Defender, and Logic Apps
• High proficiency in Kusto Query Language (KQL), with proven experience writing complex, optimized queries for detection and hunting
• Strong, demonstrated experience automating security workflows using SOAR platforms, APIs, or scripting languages (Python, PowerShell)
• Proven ability to operate with a high degree of autonomy, managing competing priorities and complex projects with minimal supervision
• In-depth knowledge of attacker TTPs, the MITRE ATT&CK framework, and modern blue team operations
• Excellent analytical and problem-solving skills, with experience in deep log analysis and digital forensics
• Strong collaboration and communication skills, with the ability to clearly explain complex technical concepts

Desirable

• BlueVoyant is seeking an experienced and proficient Security Content Engineer to join our Threat Fusion Cell (TFC)
• As a trusted and established member of our team, you will operate with a high degree of autonomy to own and enhance the detection and automation content that protects our global clients
• You are a dependable, hands-on expert in the full content lifecycle, capable of managing complex logic, optimizing for signal quality, and serving as a reliable technical resource for the team
• Own and Enhance Detection Content: Autonomously develop, test, and maintain high-fidelity detection logic in KQL for the Microsoft Sentinel environment. You will own a portfolio of content, ensuring its long-term effectiveness and performance
• Conduct Advanced Tuning & Optimization: Perform independent and complex global tuning to improve SOC efficiency and outcomes. Proactively identify and resolve sources of alert fatigue and false positives across our customer base
• Lead Threat-Informed Research: Independently research emerging threats, attack vectors, and high-risk vulnerabilities to design and develop proactive detection strategies, not just reactive rules
• Develop Scalable Automation: Design and build automation content for key security workflows, including product onboarding and incident enrichment, with a focus on reusability and efficiency
• Serve as a Technical Resource: Act as a knowledgeable point of contact for clients on complex tuning requests and provide clear guidance on detection logic. Collaborate with integration teams to define requirements for optimizing log ingestion
• Improve Team Frameworks: Contribute to the evolution of security policies and automation frameworks by providing expert feedback and identifying areas for improvement based on hands-on experience