SIEM Content Development Specialist Job at Vodafone (Newbury)

Job Description

The SIEM Content Development Specialist plays a critical role in advancing the Cyber Security Operations Center’s ability to detect and respond to cybersecurity incidents. This role focuses on designing and developing cutting-edge detection content leveraging a wide array of security technologies and telemetry to identify malicious activity and guide security analysts through effective response playbooks. Working within a threat-led framework, the specialist collaborates across teams to translate threat intelligence into actionable detection logic and response workflows. The position demands strong technical acumen, analytical thinking, and problem-solving capabilities, along with the ability to communicate clearly with peers, leadership, and cross-functional stakeholders.

Job Responsibility

Contribute to continuous improvement initiatives across multiple technologies by developing and refining content that enhanced threat detection and response capabilities
Contribute to the development and optimisation of threat detection content, including the tuning of threat and vulnerability management technologies and the continual refinement of SIEM rules and logic to enhance detection accuracy and operational performance
Lead and contribute to the optimisation and modernisation of SIEM content, supporting the adoption of next-generation SIEM technologies and cloud-native security tools
Manage the lifecycle of detection content, including development, testing, release, and retirement, using version control and documentation best practices
Collaborate with DevOps/SecOps teams to integrate security content into broader CI/CD workflows
Collaborate with the CSOC Manager to support improvements in security operations through effective content contributions
Support security event analysis by participating in and may drive security event analysis activities to address current cyber threats
Assist in threat response activities, providing analytical input from a blue team perspective to help identify potential threat group behaviours
Contribute to the creation of cyber security reports and advisories, ensuring timely and accurate dissemination to key stakeholders
Participate in residual risk assessments, supporting post-incident analysis and the documentation of operational and technical lessons learned
Collaborating with data owners and customers on understanding data sources and use cases and successfully translating requirements to actionable content

Requirements

Minimum of 2-5 years’ experience in SIEM content (rule logic and code) development role
Minimum of 2 years of SOC analyst experience (Level2 or above) required
In depth and extensive hands-on experience in security event analysis, create and refine SIEM/EDR rules and deliver efficiency within the SIEM and all other technologies used within the team
Deep knowledge of IPv4/IPv6, TCP networking protocols
Deep knowledge of Windows/Linux operating systems
Exceptional working knowledge of security technologies such as SIEM (ArcSight, Sentinel, QRadar, LogRhythm, Splunk), EDR (Microsoft Defender, FireEye, Tanium), IDS/IPS, firewalls, proxies, web application firewalls, anti-virus, etc.
Comprehensive understanding of Window Security Event logs and Syslog
Excellent familiarity with endpoint/perimeter security attack vectors and detection (blue/purple teaming)
Excellent familiarity with standard security frameworks such as MITRE, cyber kill chain and APT campaign strategies
Outstanding knowledge of cloud platforms such as Azure, O365, Google cloud, AWS, Oracle
Experience with modern SIEM platforms, including cloud-native or hybrid solutions
Hands-on experience with CI/CD pipelines and automation tools for security content deployment
Proficiency in version control systems (e.g., Git) for managing SIEM content
Excellent working knowledge of regular expression development
Kusto or SQL knowledge, including rule/query optimisation
Proven ability to prioritise workload, meet deadlines and utilise time effectively
Good interpersonal and communication skills, works effectively as a team leader and the ability
Experience in security event analytics, for example Elastic, Azure Sentinel or Splunk
3 years or above related experience
Excellent verbal and written communication skills
Highly disciplined and motivated, able to work independently or under direction
Deep understanding of threat actor techniques and tools

Nice to have

Scripting and programming experience is highly desirable
Demonstrable experience in critical thinking and data or logical analysis
Knowledge of: typical security devices such as firewalls, Intrusion detection system, anti-virus, anti-spam, Cyber threat concepts e.g. cyber kill chain, attack methods, threat actors
Cloud systems and Windows and Linux OS
Experience with investigating intrusions in Linux and cloud environments

What we offer

Yearly bonus: 10%
Annual leave: 28 days + bank holidays + the opportunity to buy/sell/carry over 5 days/year
Charity days: 5 days/year
Maternity leave: 52 weeks: the first 13 weeks are fully paid, followed by 26 weeks of half pay
Private pension: You can contribute up to 5% of your basic pay with 2:1 matching from Vodafone up to 10%
Access to: private medical, private dental, free health assessments, share save scheme
Additional discounts: Vodafone retail, gym, cinema, cycle to work, season ticket loan

Vodafone - All Job Offers

Select Country

SIEM Content Development Specialist

Job Description

Job Responsibility

Requirements

Nice to have

What we offer

Looking for more opportunities?

SIEM Content Development Specialist

Cyber Defence - Siem Content Development Specialist

Systems Engineering Senior Specialist-Vulnerability Remediation & Tanium Support

Senior Cyber Incident Management, Operations & Response Specialist - VOIS

Systems Engineering Specialist - Tanium

Systems Engineering Specialist - Tanium

Systems Engineering Specialist - Tanium

IT Training Lead

K Kitchen Representative

Our AI answers in your language