Remote UK: Threat Detection Content Engineer

BlueVoyant; United Kingdom; Remote; GBP 75,000 - 120,000; Full time

Job summary

BlueVoyant is seeking a Security Content Engineer to own and enhance detection content for the Microsoft Sentinel environment, including tuning for efficiency and reducing false positives. You will research emerging threats and design proactive detection strategies while developing scalable automation for key workflows.

Ideal candidates will have 5-8 years in detection engineering or related roles, with deep expertise in Microsoft Sentinel, 365 Defender, Logic Apps, and strong KQL skills.

Qualifications

• 5-8 years of direct experience in Detection Engineering, Security Operations or similar content-creation role.
• Hands-on expertise with the Microsoft security stack: Microsoft Sentinel, Microsoft 365 Defender, Logic Apps.
• High proficiency in Kusto Query Language (KQL) and writing optimized queries for detection/hunting.
• Strong experience automating security workflows using SOAR platforms, APIs or scripting (Python/PowerShell).
• Ability to work autonomously, manage priorities, and handle complex projects.

Responsibilities

• Own and enhance detection content with high-fidelity logic in KQL for Microsoft Sentinel.
• Perform independent global tuning to reduce alert fatigue and false positives for customers.
• Lead threat-informed research to design proactive detection strategies.
• Develop scalable automation for security workflows and incident enrichment.
• Serve as technical point of contact for clients and collaborate with integration teams.
• Contribute to evolving security policies and automation frameworks.

Skills

Detection engineering

KQL proficiency

SOAR automation

MITRE ATT&CK knowledge

Log analysis & forensics

Clear communication

Tools

Microsoft Sentinel

Microsoft 365 Defender

Logic Apps

Job description

BlueVoyant is seeking a Security Content Engineer to own and enhance detection content for the Microsoft Sentinel environment, including tuning for efficiency and reducing false positives. You will research emerging threats and design proactive detection strategies while developing scalable automation for key workflows.

Ideal candidates will have 5-8 years in detection engineering or related roles, with deep expertise in Microsoft Sentinel, 365 Defender, Logic Apps, and strong KQL skills.