Detection Content Engineer: KQL & Sentinel Automation

BlueVoyant; Greater London; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

BlueVoyant seeks a Security Content Engineer to join its Threat Fusion Cell, building automated security analysis solutions. This fully remote role in the UK focuses on developing, tuning and maintaining detection content for global clients.

You will lead threat-informed research, design scalable automation for onboarding and enrichment, and advise clients on detection logic with strong MS security stack skills and deep KQL expertise.

Qualifications

• 5-8 years of direct experience in Detection Engineering, SOC, or a similar role with a heavy focus on content creation.
• Hands-on expertise with the Microsoft security stack, including Microsoft Sentinel, Microsoft 365 Defender, and Logic Apps.
• High proficiency in Kusto Query Language (KQL), with proven experience writing complex, optimized queries for detection and hunting.
• Strong, demonstrated experience automating security workflows using SOAR platforms, APIs, or scripting languages (Python, PowerShell).
• Proven ability to operate with a high degree of autonomy, managing competing priorities and complex projects with minimal supervision.
• In-depth knowledge of attacker TTPs, the MITRE ATT&CK framework, and modern blue team operations.
• Excellent analytical and problem-solving skills, with experience in deep log analysis and digital forensics.
• Strong collaboration and communication skills, with the ability to clearly explain complex technical concepts.

Responsibilities

• Own and Enhance Detection Content: Autonomously develop, test, and maintain high-fidelity detection logic in KQL for the Microsoft Sentinel environment.
• Conduct Advanced Tuning & Optimization: Perform independent and complex global tuning to improve SOC efficiency and outcomes.
• Lead Threat-Informed Research: Independently research emerging threats, attack vectors, and high-risk vulnerabilities to design and develop proactive detection strategies.
• Develop Scalable Automation: Design and build automation content for key security workflows, including product onboarding and incident enrichment.
• Serve as a Technical Resource: Act as a knowledgeable point of contact for clients on complex tuning requests and provide clear guidance on detection logic.
• Improve Team Frameworks: Contribute to the evolution of security policies and automation frameworks by providing expert feedback.

Skills

Detection Engineering

SOC operations

KQL

Automation scripting

Python

PowerShell

MITRE ATTACK

Microsoft Sentinel

Logic Apps

Tools

Git

SOAR platforms

Job description

BlueVoyant seeks a Security Content Engineer to join its Threat Fusion Cell, building automated security analysis solutions. This fully remote role in the UK focuses on developing, tuning and maintaining detection content for global clients.

You will lead threat-informed research, design scalable automation for onboarding and enrichment, and advise clients on detection logic with strong MS security stack skills and deep KQL expertise.