Security Content Engineer
Location: London (Full time - 5 days onsite)
Salary: Up to £65,000 + bonus
Clearance: Must be eligible for UK Developed Vetting (DV) clearance
We are seeking an experienced Security Content Engineer to join a high-performing Security Operations Centre (SOC) environment. This role is focused on designing, developing, and optimising detection content to strengthen cyber defence capabilities and improve threat visibility across enterprise environments.
You will play a critical role in enhancing detection efficacy, reducing false positives, and ensuring robust coverage against evolving threat landscapes.
Key Responsibilities
- Design and implement detection use cases across SIEM and SOAR platforms using threat intelligence and incident data
- Develop, map, and maintain detection logic aligned to MITRE ATT&CK frameworks
- Continuously tune and optimise correlation rules to improve signal-to-noise ratio
- Validate detection logic through simulations, threat emulation, and red team collaboration
- Work closely with SOC tooling and engineering teams to ensure efficient data ingestion and parsing
- Document detection logic, methodologies, and expected outputs for audit and operational use
- Contribute to post-incident reviews, enhancing detection coverage and response effectiveness
- Maintain and evolve a repository of use cases, KPIs, and SOC performance metrics
Requirements
- 3+ years of commercial experience in SOC content engineering, detection engineering, or SIEM administration
- Strong hands-on experience with SIEM platforms and query languages (e.g. SPL, KQL)
- Solid understanding of detection engineering principles, data modelling, and regex
- Proven experience working with MITRE ATT&CK and threat-informed defence strategies
- Ability to design scalable and maintainable detection content in complex environments
- Strong documentation and stakeholder communication skills
Desirable
- Relevant certifications such as Splunk Enterprise Security, GIAC GCDA, or similar
- Experience with SOAR platforms and automation workflows
- Background in threat hunting or incident response
If you are a detection-focused cyber security professional who thrives on building high-quality, intelligence-led SOC content, apply today.