Senior Security Content Engineer (Automations)

Location: US Based Remote

Citizenship/Authorization : Must be authorized to work in the US (US Citizenship Preferred)

Summary: BlueVoyant is seeking a Security Consultant Content Engineering to join our fast-paced team focused on building automated security analysis solutions. This fully remote role involves developing detection logic automation and visualizations to help clients derive actionable security insights at an expert level. You’ll work closely with internal teams and customers to enhance security operations through innovative content engineering.

Key Responsibilities:

• Enrich security signals to improve SOC efficiency and outcomes

• Research threat actors and attack vectors to develop detection content for emerging threats leading research initiatives to improve out detection posture

• Design and build automation content for onboarding new products

• Design and build complex detection analytic rules improving our global detection capabilities

• Assist clients in testing and tuning detection logic to reduce false positives and alert fatigue

• Perform expert level global tuning for complex alerts.

• Identify and promote reusable content (rules automations dashboards) across clients

• Lead integration initiatives to optimize log ingestion and reduce noise

• Deliver research-driven content such as queries signatures rules and knowledge base articles. Mentor developing team-members.

• Develop supplemental detection coverage for high-risk vulnerabilities and exploits

• Develop security policies procedures and automation frameworks

• Communicate regularly with client IT teams to provide guidance and ensure operational readiness

• Support the development of incident response processes and documentation

• Advance security standard operating procedures and incident response reporting

Qualifications:

• Strong collaboration and interpersonal skills especially in distributed team environments

• Excellent written and verbal communication skills; ability to explain complex topics clearly

• Expert experience in writing detection signatures or algorithms

• Expert level proficiency in analyzing event logs and identifying indicators of compromise

• Hands-on experience with Microsoft Azure Sentinel Defender and related tools

• Deep experience with:

• Sentinel Incidents Workbooks Hunting Queries Notebooks

• Kusto Query Language (KQL) or similar

• Complex JSON structures

• Development tools (Git IDEs CI/CD pipelines)

• Expert scripting skills (Python Ruby etc.)

• Experience in digital forensics and blue team operations

• Expert understanding of network protocols and infrastructure

• Ability to gather client requirements and translate them into technical solutions

• Deep knowledge of:

• SIEM/SOAR platforms

• API integrations

• Endpoint Detection and Response (EDR)

• Log analysis and malware detection

• Network monitoring tools

• Case management systems

• Atlassian Suite (Jira Confluence)

• Email security DLP encryption and vulnerability management

Preferred Qualifications:

• Background in intrusion analysis detection engineering or penetration testing

• 12+ years of experience in IT or cybersecurity with a focus on SIEM and detection content

• Relevant certifications such as Microsoft 365 Certified: Security Administrator Associate GCFA GCFE or OSCP

Education:

• Bachelor's degree in a related field or equivalent professional experience and certifications. A master's degree in cybersecurity computer science information assurance or a similar technical field is preferred.

About BlueVoyant At BlueVoyant we recognize that effective cyber security requires active prevention and defense across both your organization and supply chain. Our proprietary data analytics and technology coupled with deep expertise works as a force multiplier to secure your full ecosystem. Accuracy! Actionability! Timeliness! Scalability!    Led by CEO Jim Rosenthal BlueVoyant’s highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency Federal Bureau of Investigation Unit 8200 and GCHQ together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.    Founded in 2017 by Fortune 500 executives including Executive Chairman Tom Glocer and former Government cyber officials BlueVoyant is headquartered in New York City and has offices in Maryland Tel Aviv San Francisco London Budapest and Latin America.    BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with additional insights to support fair and efficient hiring decisions. Please note that all applications are reviewed by a member of our hiring team and final hiring decisions are made by humans not AI. By submitting your application you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process. For more information on how we process your personal data please review our Candidate Privacy Notice available at https://www.bluevoyant.com/candidate-privacy-notice .

All employees must be authorized to work in the United States. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race color religion sex national origin age disability or genetics. In addition to federal law requirements BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.    Disclaimer: Please note that pursuant to contractual requirements and applicable law in order for employees to perform work on some of the company’s federal contracts U.S. citizenship is required. Accordingly an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status. Furthermore individuals may be subject to additional background checks and fingerprinting.

BlueVoyant Candidate Privacy Notice

To understand how we secure and manage your personal data upon submitting a job application please see our Candidate Privacy Notice which can be found here - Candidate Privacy Notice