SIEM Content Development Specialist - VOIS
Core
Develop, refine, and optimize security content and detection rules for SIEM, EDR, and XDR technologies to enhance the Cyber Security Operations Centre's detection capabilities.
Role type
Senior IC SIEM Content Development Specialist
Builds
Detection scenarios, SIEM rules, threat-response workflows, and playbooks for the CSOC
Domain
Cyber Security Operations / Threat Intelligence
Required skills
SIEM content engineering, threat hunting, threat intelligence, MITRE ATT&CK TTPs, security event analysis, Python, KQL, YARA-L, SQL, PowerShell, Regex, networking protocols, SDLC/Agile methodologies
Preferred skills
Team leadership, project management, telecommunications industry experience, advanced threat evasion analysis
Technologies
ArcSight, ELK/Elastic, Splunk, Microsoft Sentinel, Google SecOps, SOAR, AWS, GCP, Microsoft Azure, Oracle
Responsibilities
Translate threat intelligence and adversary behavior into indicator-based detections; tune SIEM rules and correlation logic; develop and integrate threat-response workflows; collaborate with log-source owners to clarify detection requirements; contribute to post-incident analysis and residual-risk assessments; develop security content automation using scripting languages.
Seniority
Senior, hands-on IC
