SIEM Content Development Specialist - VOIS
Core
Develop, tune, and improve SIEM, EDR, and XDR detection content to translate threat intelligence and business requirements into effective cyber defense capabilities.
Role type
Senior IC SIEM Content Development Specialist
Builds
Detection rules, use cases, and threat-response workflows for Elastic Security/ELK, ArcSight, and other SIEM platforms
Domain
Cyber Security Operations (CSOC), Threat Intelligence, SIEM Engineering
Required skills
SIEM content development, Elastic Security/ELK, KQL, ES|QL, Regex, MITRE ATT&CK, Python, SQL, JavaScript, PowerShell, threat hunting, security engineering
Preferred skills
ArcSight, Microsoft Sentinel, Splunk, cloud telemetry (AWS, GCP, Microsoft), software engineering, networking concepts, security reporting frameworks
Technologies
Elastic Security/ELK, ArcSight, Microsoft Sentinel, Splunk, Chronicle, Python, SQL, JavaScript, PowerShell, KQL, ES|QL, Logstash, Kibana
Responsibilities
Develop and enhance detection content across SIEM, EDR, and XDR technologies; Create threat scenarios and SIEM detection rules/use cases; Tune detection rules and correlation logic; Analyse adversaries and attack techniques to create indicator-based detections; Map security detections to MITRE ATT&CK TTPs; Collaborate with log-source owners to translate requirements into actionable content; Contribute to threat-response workflows and playbook development; Develop security content using scripting languages and Regex; Perform post-incident analysis and improve detection capabilities
Seniority
Senior, hands-on IC
