Remote Senior Security Content Engineer: Detection

BlueVoyant; Northern (KY); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Competitive compensation

Comprehensive benefits package

Wellbeing and career development

Job summary

BlueVoyant is a remote role seeking a Senior Security Content Engineer to join the Threat Fusion Cell. You will develop detection logic, automation, and visualizations to help clients derive actionable security insights at an expert level.

You’ll collaborate with internal teams and customers to enhance security operations through innovative content engineering. The role requires expert-level experience with SIEM/EDR, Azure, Sentinel, Defender, and scripting in Python or Ruby, with a focus on

Qualifications

• Bachelor's degree in a related field or equivalent professional experience.
• 10+ years IT or cybersecurity experience focused on SIEM and detection content.
• Expert experience writing detection signatures or algorithms.

Responsibilities

• Enrich security signals to improve SOC efficiency and outcomes.
• Research threat actors and attack vectors to develop detection content for emerging threats.
• Design and build automation content for onboarding new products.
• Design and build complex detection analytic rules to improve global detection.
• Assist clients in tuning detection logic to reduce false positives and alert fatigue.
• Mentor developing team members.
• Develop supplemental detection coverage for high-risk vulnerabilities and exploits.

Skills

Detection content engineering

Threat research

SOCs and blue team

Communication

Client guidance

Education

Bachelor's degree or equivalent

Master's degree preferred

Tools

Azure

Sentinel

Defender

KQL

Git

IDEs

CI/CD

Confluence

Jira

Job description

BlueVoyant is a remote role seeking a Senior Security Content Engineer to join the Threat Fusion Cell. You will develop detection logic, automation, and visualizations to help clients derive actionable security insights at an expert level.

You’ll collaborate with internal teams and customers to enhance security operations through innovative content engineering. The role requires expert-level experience with SIEM/EDR, Azure, Sentinel, Defender, and scripting in Python or Ruby, with a focus on