Content Developer | Remote in Slough

Job Description \n SIEM Content Developer - ArcSight & Google SecOps - 3-month contract - £450 per day (Outside IR35) - Reading/Hybrid \n We are seeking a SIEM Content Developer with proven experience in ArcSight and Google SecOps (Chronicle) to design, build and optimise security detections across a large enterprise security environment. \n Key Responsibilities \n \n Develop, test and tune detection rules and correlation logic within ArcSight and Google SecOps. \n Create and maintain use cases, dashboards, reports and threat detection content. \n Develop behavioural detections aligned to MITRE ATT&CK and threat intelligence. \n Onboard, parse and normalise log sources to improve visibility and detection coverage. \n Work closely with SOC teams to improve alert fidelity, reduce false positives and close detection gaps. \n Develop automation and response workflows within the SIEM ecosystem. \n \n Required Experience \n \n Strong hands-on experience with ArcSight ESM. \n Strong hands-on experience with Google SecOps (Chronicle). \n Experience creating and tuning SIEM correlation rules and detection content. \n Experience developing Google SecOps detection rules using YARA-L. \n Strong understanding of security monitoring, threat detection and SOC operations. \n Experience mapping detections to the MITRE ATT&CK framework. \n Experience integrating and analysing security logs from multiple sources. \n Knowledge of SIEM content life cycle management and detection optimisation. \n