> Markdown version of [/jobs/ext/2707747-security-content-engineer](https://www.wearedevelopers.com/jobs/ext/2707747-security-content-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Content Engineer - **Company:** BlueVoyant - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Software System Penetration Testing, Microsoft Azure, Cyber Security, Programming Tools, Digital Forensics, Intrusion Detection and Prevention, JSON, Python (Programming Language), Log Analysis, Network Monitoring, Network Protocols, Ruby, Kusto Query Language, Security Information and Event Management, Software Vulnerability Management, Scripting, Git, Build Management, Information Technology, Atlassian Tools, Malware Detection, Api Management, Blue Team (Cyber Security) - **Published:** September 4, 2026 - **Apply:** http://bluevoyant.applytojob.com/apply/jobs/details/8M4SFuXPnK ## About the Role * Strong collaboration and interpersonal skills, especially in distributed team environments. * Excellent written and verbal communication skills, with the ability to explain complex topics clearly. * Expert experience writing detection signatures or algorithms. * Expert-level proficiency in analyzing event logs and identifying indicators of compromise. * Hands-on experience with Microsoft Azure, Sentinel, Defender, and related tools. * Deep experience with: + Sentinel Incidents, Workbooks, Hunting Queries, and Notebooks + Kusto Query Language (KQL) or similar + Complex JSON data structures + Development tools, including Git, IDEs, and CI/CD pipelines * Expert scripting skills in Python, Ruby, or similar languages. * Experience in digital forensics and blue team operations. * Expert understanding of network protocols and infrastructure. * Ability to gather client requirements and translate them into technical solutions. * Strong knowledge of: + SIEM and SOAR platforms + API integrations + Endpoint Detection and Response (EDR) + Log analysis and malware detection + Network monitoring tools + Case management systems + Atlassian Suite (Jira and Confluence) + Email security, DLP, encryption, and vulnerability management Nice to Have: * Background in intrusion analysis, detection engineering, or penetration testing. * 10+ years of experience in IT or cybersecurity, with a focus on SIEM and detection content. * Relevant certifications such as: Microsoft 365 Certified: Security Administrator Associate, GCFA, GCFE, OSCP Education: * Bachelor's degree in a related field or equivalent professional experience and certifications. * A Master's degree in Cybersecurity, Computer Science, Information Assurance, or a related technical field is preferred. ## Description BlueVoyant is seeking a Senior Security Content Engineer to join our fast-paced team in the Threat Fusion Cell, focused on building automated security analysis solutions. This fully remote role involves developing detection logic, automation, and visualizations to help clients derive actionable security insights at an expert level. You'll work closely with internal teams and customers to enhance security operations through innovative content engineering.What You'll Do: * Enrich security signals to improve SOC efficiency and outcomes. * Research threat actors and attack vectors to develop detection content for emerging threats and improve our detection posture. * Design and build automation content for onboarding new products. * Design and build complex detection analytic rules, improving our global detection capabilities. * Assist clients in testing and tuning detection logic to reduce false positives and alert fatigue. * Perform expert-level global tuning for complex alerts. * Identify and promote reusable content, including rules, automations, and dashboards, across clients. * Lead integration initiatives to optimize log ingestion and reduce noise. Deliver research-driven content such as queries, signatures, rules, and knowledge base articles. * Develop supplemental detection coverage for high-risk vulnerabilities and exploits. * Develop security policies, procedures, and automation frameworks. * Communicate regularly with client IT teams to provide guidance and ensure operational readiness. * Support the development of incident response processes and documentation. * Advance security standard operating procedures and incident response reporting. * Mentor developing team members. ## Related Videos - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Coffee with Developers: David Heinemeier Hansson](https://www.wearedevelopers.com/videos/875-coffee-with-developers-david-heinemeier-hansson) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)