Senior Security Content Engineer

Join BlueVoyant as a Senior Security Content Engineer in a fully remote role. You will develop automated security analysis solutions, enhance security operations, and improve SOC efficiency. Your responsibilities will include researching threat actors, designing detection analytic rules, assisting clients in testing detection logic, and mentoring team members. You will also have access to a comprehensive benefits package, including medical, dental, and vision coverage, retirement plans, and generous paid time off.

Responsibilities

• Concevoir et construire des règles d'analyse de détection complexes, améliorant nos capacités de détection à l'échelle mondiale.
• Rechercher des acteurs de la menace et des vecteurs d'attaque pour développer du contenu de détection pour les menaces émergentes.
• Identifier et promouvoir du contenu réutilisable, y compris des règles, des automatisations et des tableaux de bord, auprès des clients.
• Ability to gather client requirements and translate them into technical solutions
• Log analysis and malware detection
• Email security, DLP, encryption, and vulnerability management
• Sentinel Incidents, Workbooks, Hunting Queries, and Notebooks
• Case management systems
• Expert-level proficiency in analyzing event logs and identifying indicators of compromise

Requirements

• Kusto Query Language (KQL) or similar
• Complex JSON data structures
• Experience in digital forensics and blue team operations
• Strong knowledge of:
• Atlassian Suite (Jira and Confluence)
• Excellent written and verbal communication skills, with the ability to explain complex topics clearly
• SIEM and SOAR platforms
• Expert understanding of network protocols and infrastructure
• Network monitoring tools

Deep experience with

• Strong collaboration and interpersonal skills, especially in distributed team environments
• Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools

Endpoint Detection and Response (EDR)

• Bachelor's degree in a related field or equivalent professional experience and certifications
• Relevant certifications such as: Microsoft 365 Certified: Security Administrator Associate, GCFA, GCFE, OSCP
• 10+ years of experience in IT or cybersecurity, with a focus on SIEM and detection content

Preferred

• Expert experience writing detection signatures or algorithms
• Development tools, including Git, IDEs, and CI/CD pipelines

API integrations

• Expert scripting skills in Python, Ruby, or similar languages
• A Master's degree in Cybersecurity, Computer Science, Information Assurance, or a related technical field is preferred
• Background in intrusion analysis, detection engineering, or penetration testing