Siem Content Development Specialist - Cyber Defence - Vois

• Design, develop, and optimise SIEM detection content across existing and new platforms
• Lead and contribute to SIEM content engineering initiatives, applying SDLC and Agile methodologies
• Continuously refine detection rules and logic to improve SOC efficiency and effectiveness
• Develop and integrate threat response workflows and playbooks
• Conduct threat analysis to design behavioural and indicator-based detection use cases
• Collaborate with log source owners to translate business and technical requirements into actionable SIEM content
• Deliver cyber security reports and advisories to key stakeholders
• Perform post-incident analysis and drive improvements through actionable insights
• Support EDR/XDR detection engineering and tuning activities
• Create and maintain technical documentation, workflows, and operational playbooks

• Experienced professional with 10+ years in SOC operations, SIEM content development, threat hunting, or security engineering
• Skilled in SIEM technologies, particularly Elastic/ELK, with knowledge of platforms such as Splunk, Sentinel, ArcSight, or Chronicle
• Proficient in programming and scripting (e.g., Python, SQL, JavaScript, PowerShell, KQL, ES|QL)
• Strong understanding of cloud environments (AWS, Azure, GCP) and associated telemetry
• Experienced in developing detection use cases and threat scenarios aligned with MITRE ATT&CK and cyber kill chain frameworks
• Competent in Regex and data analysis techniques
• Knowledgeable in networking concepts (TCP/IP, CIDR, subnets) and security tools (IDS/IPS, firewalls, AV systems)
• Strong analytical, problem-solving, and communication skills
• Able to work independently, prioritise tasks, and collaborate effectively across teams
• Certifications such as CISSP or SANS (e.g., GCIH, GCIA) are advantageous

Certifications such as CISSP or SANS (e.g., GCIH, GCIA) are advantageous

• Opportunity to work at the core of global cyber defence operations
• Exposure to advanced SIEM, EDR, and XDR technologies and large-scale security environments
• Collaboration with global cyber security experts and stakeholders
• Continuous learning through evolving threat landscapes and modern security frameworks
• Opportunity to contribute to meaningful risk reduction initiatives across Vodafone