Remote Security Content Engineer: Detection & Automation

BlueVoyant; United States; Remote; USD 101,000 - 149,000; Full time

Job summary

BlueVoyant is seeking a SecurityContent Engineer to own and enhance detection content for Microsoft Sentinel in a remote UK setting. You will develop, test, and maintain high-fidelity detection logic using KQL, and collaborate with customers on tuning requests.

The role emphasizes threat-informed research, scalable automation, and deep log analysis, with hands-on work across MITRE ATT&CK, M365 Defender, and Logic Apps.

Qualifications

• 5–8 years in detection engineering or security operations focusing on content.
• Deep hands-on expertise with the Microsoft security stack and KQL.
• Experience automating workflows using SOAR, APIs, or scripting (Python/PowerShell).

Responsibilities

• Own and enhance detection content in Microsoft Sentinel using high-fidelity KQL.
• Tune and optimize global detections to reduce false positives.
• Lead threat-informed research to design proactive detection strategies.
• Develop scalable automation for security workflows and onboarding.
• Serve as a technical resource for clients on tuning requests.
• Improve security policies and automation frameworks with hands-on feedback.

Skills

KQL

Microsoft Sentinel

M365 Defender

Logic Apps

SOAR automation

Python

PowerShell

MITRE ATT&CK

Digital forensics

Communication

Git

Tools

Git

Job description

BlueVoyant is seeking a SecurityContent Engineer to own and enhance detection content for Microsoft Sentinel in a remote UK setting. You will develop, test, and maintain high-fidelity detection logic using KQL, and collaborate with customers on tuning requests.

The role emphasizes threat-informed research, scalable automation, and deep log analysis, with hands-on work across MITRE ATT&CK, M365 Defender, and Logic Apps.