SIEM Content Development Team Lead
Role details
Job location
Tech stack
Job description
analysis from blue team perspective to identify possible threat group activity.Security Reporting and Advisories - take part in and may drive the delivery of cyber security reports and advisories to all key stakeholders.Champion detection-as-code practices, including version control, peer review, and CI/CD pipelines for rule deployment.Foster a culture of continuous learning and innovation within the team, including mentoring, knowledge sharing, and cross-functional collaboration.Partner with platform and engineering teams to ensure detection logic is scalable, resilient, and aligned with infrastructure changes.Residual Risk Assessment - take part in and may drive the delivery of 'operational and technical' lessons learnt post incident analysis and reporting.Collaborating with data owners and customers on understanding data sources and use cases and successfully translating requirements to actionable content.Who you areMinimum of 2-5 years' experience in SIEM content (rule logic and, Head of Sales, Europe Location: Newbury, UK Top rated by Gartner, eGain AI Knowledge Hub orchestrates AI and experts to deliver trusted answers to customers, agents, and field staff. We will not waste your time. At eGain, we've spent years building what Gartner calls the...
Requirements
security analysts, using a threat led approach. This role requires strong technical, analytical, problem solving skills as well as the ability to communicate effectively with leadership, peers and across other team boundaries. This role also champions detection-as-code practices, automation, and collaboration across threat intelligence, incident response, and engineering teams to ensure scalable and resilient detection capabilities.Key accountabilities and decision ownership:Lead the team in driving continuous improvement across multiple technologies.Lead and contribute to content development - optimal tuning and operation of the threat and vulnerability management technologies.Continually refining the rules and logic within the Vodafone SIEM.Work with CSOC Principal Manager to improve security operations.Security Analysis - take part in and may drive security event analysis activities to address current Cyber threats.Threat Response - may require engagement and possibly driving the, code) development role.Experience in a Security Operations Centre (SOC) or similar environment, with modern threat landscapes and attack techniques.Proven experience in leading technical teams or line management, with the ability to mentor, develop, and manage performance across a diverse group of security professionals.Experience collaborating with cross-functional teams including threat intelligence, incident response, and platform engineering.In depth and extensive hands-on experience in security event analysis, create and refine SIEM/EDR rules and deliver efficiency within the SIEM and all other technologies used within the team.Experience in threat modelling methodologies (eg STRIDE, PASTA or attack trees).Ability to translate threat scenarios and intelligence into actionable detection logic and measurable outcomes.Deep knowledge of IPv4/IPv6, TCP networking protocols.Deep knowledge of Windows/Linux operating systems.Exceptional working knowledge of security technologies such as SIEM (Google SecOps, ArcSight, Sentinel, QRadar, LogRhythm, Splunk), EDR (Microsoft Defender, FireEye, Tanium), IDS/IPS, firewalls, proxies, web application firewalls, anti-virus, etc.Comprehensive understanding of Window Security Event logs and Syslog.Excellent familiarity with endpoint/perimeter security attack vectors and detection (blue/purple teaming).Excellent familiarity with standard security frameworks such as MITRE, cyber kill chain and APT campaign strategies.Outstanding knowledge of cloud platforms such as Azure, O365, Google cloud, AWS, Oracle.Excellent working knowledge of regular expression development.Scripting and programming experience is highly desirable.Kusto or SQL knowledge, including rule/query optimisation.Yara-L knowledge, including rule/query optimisation.Familiarity with detection-as-code tooling and practices (, Git, CI/CD pipelines for rule testing and deployment).Experience in security event analytics, for example Elastic, Azure Sentinel or Splunk.Experience in building or maturing security culture initiatives, including awareness programs, gamified training, or executive engagement.#J-18808-Ljbffr Similar jobs, A leading telecom company is seeking a SIEM Content Development Team Lead in Newbury, UK, to lead a skilled team in the detection of cybersecurity incidents. This role requires a minimum of 2-5 years of experience in SIEM content development and strong leadership skills....
