Senior Security Content Engineer

BlueVoyant; United Kingdom; Remote; GBP 80,000 - 110,000; Full time

Job summary

BlueVoyant is seeking a Senior Security Content Engineer to join the Threat Fusion Cell in a fully remote role based in the UK. You will develop automated detection content, signatures, and dashboards to enhance security operations and deliver actionable insights for clients.

You will collaborate with internal teams and clients, tuning detection logic, onboarding new products, and mentoring junior engineers while advancing incident response practices and security content reuse.

Qualifications

• Expert experience writing detection signatures or algorithms.
• Expert-level proficiency in analyzing event logs and identifying indicators of compromise.
• Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools.
• Deep experience with Sentinel Incidents, Workbooks, Hunting Queries, and Notebooks.
• KQL or similar; JSON data structures; Git, IDEs, and CI/CD pipelines.

Responsibilities

• Enrich security signals to improve SOC efficiency and outcomes.
• Research threat actors and attack vectors to develop detection content for emerging threats.
• Design and build automation content for onboarding new products.
• Develop complex detection analytic rules to enhance global detection capabilities.
• Assist clients in testing and tuning detection logic to reduce false positives.
• Perform expert-level tuning for complex alerts.
• Identify and promote reusable content across clients.
• Lead integration initiatives to optimize log ingestion and reduce noise.
• Deliver research-driven content such as queries, signatures, rules, and knowledge base articles.
• Develop supplemental detection coverage for high-risk vulnerabilities and exploits.
• Develop security policies, procedures, and automation frameworks.
• Communicate regularly with client IT teams to ensure operational readiness.
• Support incident response processes and documentation.
• Advance security SOPs and incident response reporting.
• Mentor developing team members.

Skills

Detection signatures

Event log analysis

Azure Sentinel

Kusto Query Language

JSON data structures

Git/CI/CD

Python

Digital forensics

Network protocols

SIEM SOAR

API integrations

EDR

Education

Bachelor's degree in related field

Master's degree in Cybersecurity/CS/IA

Tools

Git

IDEs

CI/CD pipelines

Sentinel Notebooks

Notebooks

Job description

Position: Senior Security Content Engineer

Reports To: Manager, Content Engineering

Department: Threat Fusion Cell

Location: Remote, UK

Work Authorization: Right to Work in the UK Required

BlueVoyant is seeking a Senior Security Content Engineer to join our fast-paced team in the Threat Fusion Cell, focused on building automated security analysis solutions. This fully remote role involves developing detection logic, automation, and visualizations to help clients derive actionable security insights at an expert level. You'll work closely with internal teams and customers to enhance security operations through innovative content engineering.

What You'll Do

• Enrich security signals to improve SOC efficiency and outcomes.
• Research threat actors and attack vectors to develop detection content for emerging threats and improve our detection posture.
• Design and build automation content for onboarding new products.
• Design and build complex detection analytic rules, improving our global detection capabilities.
• Assist clients in testing and tuning detection logic to reduce false positives and alert fatigue.
• Perform expert-level global tuning for complex alerts.
• Identify and promote reusable content, including rules, automations, and dashboards, across clients.
• Lead integration initiatives to optimize log ingestion and reduce noise. Deliver research-driven content such as queries, signatures, rules, and knowledge base articles.
• Develop supplemental detection coverage for high-risk vulnerabilities and exploits.
• Develop security policies, procedures, and automation frameworks.
• Communicate regularly with client IT teams to provide guidance and ensure operational readiness.
• Support the development of incident response processes and documentation.
• Advance security standard operating procedures and incident response reporting.
• Mentor developing team members.

What You'll Bring

• Strong collaboration and interpersonal skills, especially in distributed team environments.
• Excellent written and verbal communication skills, with the ability to explain complex topics clearly.
• Expert experience writing detection signatures or algorithms.
• Expert-level proficiency in analyzing event logs and identifying indicators of compromise.
• Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools.
• Deep experience with:
  • Sentinel Incidents, Workbooks, Hunting Queries, and Notebooks
  • Kusto Query Language (KQL) or similar
  • Complex JSON data structures
  • Development tools, including Git, IDEs, and CI/CD pipelines
• Expert scripting skills in Python, Ruby, or similar languages.
• Experience in digital forensics and blue team operations.
• Expert understanding of network protocols and infrastructure.
• Ability to gather client requirements and translate them into technical solutions.
• Strong knowledge of:
  • SIEM and SOAR platforms
  • API integrations
  • Endpoint Detection and Response (EDR)
  • Log analysis and malware detection
  • Network monitoring tools
  • Case management systems
  • Atlassian Suite (Jira and Confluence)
  • Email security, DLP, encryption, and vulnerability management

Nice to Have

• Background in intrusion analysis, detection engineering, or penetration testing.
• 10+ years of experience in IT or cybersecurity, with a focus on SIEM and detection content.
• Relevant certifications such as: Microsoft 365 Certified: Security Administrator Associate, GCFA, GCFE, OSCP

Education

• Bachelor's degree in a related field or equivalent professional experience and certifications.
• A Master's degree in Cybersecurity, Computer Science, Information Assurance, or a related technical field is preferred.

Why BlueVoyant?

• Develop innovative detection content, automation, and analytics that enhance security operations and help customers stay ahead of evolving threats.
• Work at the intersection of threat research, detection engineering, and security operations, delivering scalable solutions used across diverse customer environments.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.

About BlueVoyant

BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digital footprints as a single attack surface. The company’s award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance.

Led by CEO, John Hernandez, BlueVoyant’s highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.

All employees must have the right to work in the United Kingdom. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to age, disability, gender reassignment, marriage or civil partnership status, pregnancy or maternity, race, religion or belief, sex, or sexual orientation. BlueVoynt complies with the Equality Act 2010 and all other applicable UK employment legislation in every location in which the company has facilities.

Disclaimer: Please note that candidates will be required to provide evidence of their right to work in the United Kingdom prior to commencing employment, in line with UK immigration law. Where a role requires government or client security clearance (e.g. SC/DV), continued employment on that contract is contingent upon obtaining and maintaining the relevant clearance.