SIEM Content Developer in Reading

Job Description

SIEM Content Developer - ArcSight & Google SecOps - 3-month contract - £450 per day (Outside IR35) - Reading/Hybrid

We are seeking a SIEM Content Developer with proven experience in ArcSight and Google SecOps (Chronicle) to design, build and optimise security detections across a large enterprise security environment.

Key Responsibilities

• Develop, test and tune detection rules and correlation logic within ArcSight and Google SecOps.
• Create and maintain use cases, dashboards, reports and threat detection content.
• Develop behavioural detections aligned to MITRE ATT&CK and threat intelligence.
• Onboard, parse and normalise log sources to improve visibility and detection coverage.
• Work closely with SOC teams to improve alert fidelity, reduce false positives and close detection gaps.
• Develop automation and response workflows within the SIEM ecosystem.

Required Experience

• Strong hands-on experience with ArcSight ESM.
• Strong hands-on experience with Google SecOps (Chronicle).
• Experience creating and tuning SIEM correlation rules and detection content.
• Experience developing Google SecOps detection rules using YARA-L.
• Strong understanding of security monitoring, threat detection and SOC operations.
• Experience mapping detections to the MITRE ATT&CK framework.
• Experience integrating and analysing security logs from multiple sources.
• Knowledge of SIEM content life cycle management and detection optimisation.