Security Content Engineer

BlueVoyant; Greater London; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

BlueVoyant seeks a Security Content Engineer to join its Threat Fusion Cell, building automated security analysis solutions. This fully remote role in the UK focuses on developing, tuning and maintaining detection content for global clients.

You will lead threat-informed research, design scalable automation for onboarding and enrichment, and advise clients on detection logic with strong MS security stack skills and deep KQL expertise.

Qualifications

• 5-8 years of direct experience in Detection Engineering, SOC, or a similar role with a heavy focus on content creation.
• Hands-on expertise with the Microsoft security stack, including Microsoft Sentinel, Microsoft 365 Defender, and Logic Apps.
• High proficiency in Kusto Query Language (KQL), with proven experience writing complex, optimized queries for detection and hunting.
• Strong, demonstrated experience automating security workflows using SOAR platforms, APIs, or scripting languages (Python, PowerShell).
• Proven ability to operate with a high degree of autonomy, managing competing priorities and complex projects with minimal supervision.
• In-depth knowledge of attacker TTPs, the MITRE ATT&CK framework, and modern blue team operations.
• Excellent analytical and problem-solving skills, with experience in deep log analysis and digital forensics.
• Strong collaboration and communication skills, with the ability to clearly explain complex technical concepts.

Responsibilities

• Own and Enhance Detection Content: Autonomously develop, test, and maintain high-fidelity detection logic in KQL for the Microsoft Sentinel environment.
• Conduct Advanced Tuning & Optimization: Perform independent and complex global tuning to improve SOC efficiency and outcomes.
• Lead Threat-Informed Research: Independently research emerging threats, attack vectors, and high-risk vulnerabilities to design and develop proactive detection strategies.
• Develop Scalable Automation: Design and build automation content for key security workflows, including product onboarding and incident enrichment.
• Serve as a Technical Resource: Act as a knowledgeable point of contact for clients on complex tuning requests and provide clear guidance on detection logic.
• Improve Team Frameworks: Contribute to the evolution of security policies and automation frameworks by providing expert feedback.

Skills

Detection Engineering

SOC operations

KQL

Automation scripting

Python

PowerShell

MITRE ATTACK

Microsoft Sentinel

Logic Apps

Tools

Git

SOAR platforms

Job description

Job Title: SecurityContent Engineer
Reports To: Manager, Content Engineering
Department: Threat Fusion Cell
Location: Remote, UK
Work Authorization: UK Citizenship Required
BlueVoyant is seeking a Security Content Engineer to join our fast-paced team in the Threat Fusion Cell focused on building automated security analysis solutions. This fully remote role will focus on developing, tuning, and maintaining the detection and automation content that protects our global clients. This role is ideal for a professional who is proficient in the content lifecycle and is looking to deepen their expertise in a fast-paced, collaborative environment.

What You'll Do:

• Own and Enhance Detection Content:Autonomously develop, test, andmaintainhigh-fidelity detection logic in KQL for the Microsoft Sentinel environment. You will own a portfolio of content, ensuring its long-term effectiveness and performance.
• Conduct Advanced Tuning & Optimization:Perform independent and complex global tuning to improve SOC efficiency and outcomes. Proactivelyidentifyand resolve sources of alert fatigue and false positives across our customer base.
• Lead Threat-Informed Research:Independently research emerging threats, attack vectors, and high-risk vulnerabilities to design and develop proactive detection strategies, not just reactive rules.
• Develop Scalable Automation:Design and build automation content for key security workflows, including product onboarding and incident enrichment, with a focus on reusability and efficiency.
• Serve as a Technical Resource:Act as a knowledgeable point of contact for clients on complex tuning requests andprovideclear guidance on detection logic. Collaborate with integration teams to define requirements foroptimizinglog ingestion.
• Improve Team Frameworks:Contribute to the evolution of security policies and automation frameworks by providing expert feedback andidentifyingareas for improvement based on hands-on experience.

What You'll Bring:

• 5-8 years of direct experiencein Detection Engineering, Security Operations, or a similar role with a heavy focus on content creation.
• Deep, hands-onexpertisewith the Microsoft security stack, including Microsoft Sentinel, Microsoft 365 Defender, and Logic Apps.
• Highproficiencyin Kusto Query Language (KQL), with proven experience writing complex, optimized queries for detection and hunting.
• Strong,demonstratedexperience automating security workflowsusing SOAR platforms, APIs, or scripting languages (Python, PowerShell).
• Proven ability tooperate with a high degree of autonomy, managing competing priorities and complex projects with minimal supervision.
• In-depth knowledge of attacker TTPs, the MITRE ATT&CK framework, and modern blue team operations.
• Excellent analytical and problem-solving skills, with experience in deep log analysis and digital forensics.
• Strong collaboration and communication skills, with the ability to clearly explain complex technical concepts.

Nice To Have:

• Experience in a large-scale Managed Detection and Response (MDR) environment.
• Familiarity with CI/CD pipelines and version control (Git) for managing "detections-as-code."
• Advanced industry certifications such as GCIH, GDAT, GCFA, or OSCP.

Why BlueVoyant?

• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation, comprehensive benefits, flexible work arrangements, and opportunities for professional growth and development.
• Play a key role in developing and optimizing detection content that directly strengthens the security posture of global clients.
• Gain hands-on experience with Microsoft Sentinel, KQL, threat-informed detection engineering, and security automation in a collaborative, high-impact environment.

About BlueVoyant

BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization's network, identities, vendors, and digital footprints as a single attack surface. The company's award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance.

Led by CEO, John Hernandez, BlueVoyant's highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.

All employees must be authorized to work in the United Kingdom. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements, BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.

Important Information for Applicants:

BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with added insights to support fair and efficient hiring decisions. All applications are reviewed by a member of our hiring team, and final hiring decisions are made by humans, not AI. By submitting your application, you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process.

Interview Expectations:

As part of our interview process, we assess your experience through real-time discussion, so we expect responses to be your own. While we embrace the use of AI within our business and recruitment process, we do not permit its use during interviews. Any suspected use of AI during an interview will be challenged, and this may include the use of detection tools.

BlueVoyant Candidate Privacy Notice:

To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice