SIEM Content Development Specialist
Core
Designing and developing cutting-edge detection content and response playbooks for the Cyber Security Operations Center to detect and respond to cybersecurity incidents.
Role type
SIEM Content Development Specialist
Builds
Detection content, SIEM rules, and response workflows for the CSOC
Domain
Cybersecurity / SIEM / Threat Detection
Required skills
SIEM rule logic development, security event analysis, IPv4/IPv6 and TCP networking, Windows/Linux OS, SIEM platforms (ArcSight, Sentinel, QRadar, LogRhythm, Splunk), EDR (Microsoft Defender, FireEye, Tanium), IDS/IPS, firewalls, proxies, WAF, anti-virus, MITRE ATT&CK, cyber kill chain, APT strategies, cloud platforms (Azure, O365, Google Cloud, AWS, Oracle), CI/CD pipelines, Git, regular expressions, Kusto, SQL
Preferred skills
Scripting and programming, Elastic, Azure Sentinel, Splunk, intrusion investigation in Linux and cloud environments
Responsibilities
Develop and refine SIEM rules and logic to enhance detection accuracy, manage the lifecycle of detection content including testing and release, collaborate with DevOps/SecOps to integrate content into CI/CD workflows, support security event analysis and threat response activities, contribute to cyber security reports and advisories, participate in residual risk assessments and post-incident analysis, translate data source requirements into actionable content.
Seniority
Mid-level (2-5 years experience)
