Senior Security Content Engineer - Remote UK (Threat Fusion)

BlueVoyant; United Kingdom; Remote; GBP 80,000 - 110,000; Full time

Job summary

BlueVoyant is seeking a Senior Security Content Engineer to join the Threat Fusion Cell in a fully remote role based in the UK. You will develop automated detection content, signatures, and dashboards to enhance security operations and deliver actionable insights for clients.

You will collaborate with internal teams and clients, tuning detection logic, onboarding new products, and mentoring junior engineers while advancing incident response practices and security content reuse.

Qualifications

• Expert experience writing detection signatures or algorithms.
• Expert-level proficiency in analyzing event logs and identifying indicators of compromise.
• Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools.
• Deep experience with Sentinel Incidents, Workbooks, Hunting Queries, and Notebooks.
• KQL or similar; JSON data structures; Git, IDEs, and CI/CD pipelines.

Responsibilities

• Enrich security signals to improve SOC efficiency and outcomes.
• Research threat actors and attack vectors to develop detection content for emerging threats.
• Design and build automation content for onboarding new products.
• Develop complex detection analytic rules to enhance global detection capabilities.
• Assist clients in testing and tuning detection logic to reduce false positives.
• Perform expert-level tuning for complex alerts.
• Identify and promote reusable content across clients.
• Lead integration initiatives to optimize log ingestion and reduce noise.
• Deliver research-driven content such as queries, signatures, rules, and knowledge base articles.
• Develop supplemental detection coverage for high-risk vulnerabilities and exploits.
• Develop security policies, procedures, and automation frameworks.
• Communicate regularly with client IT teams to ensure operational readiness.
• Support incident response processes and documentation.
• Advance security SOPs and incident response reporting.
• Mentor developing team members.

Skills

Detection signatures

Event log analysis

Azure Sentinel

Kusto Query Language

JSON data structures

Git/CI/CD

Python

Digital forensics

Network protocols

SIEM SOAR

API integrations

EDR

Education

Bachelor's degree in related field

Master's degree in Cybersecurity/CS/IA

Tools

Git

IDEs

CI/CD pipelines

Sentinel Notebooks

Notebooks

Job description

BlueVoyant is seeking a Senior Security Content Engineer to join the Threat Fusion Cell in a fully remote role based in the UK. You will develop automated detection content, signatures, and dashboards to enhance security operations and deliver actionable insights for clients.

You will collaborate with internal teams and clients, tuning detection logic, onboarding new products, and mentoring junior engineers while advancing incident response practices and security content reuse.