{"id":1184528,"url":"https://alion.io/job/vodacom-mozambique-siem-content-development-specialist","title":"SIEM Content Development Specialist","company":{"id":51587,"name":"Vodafone Group","domain":"vodafone.com","url":"https://alion.io/company/vodafone-group","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Eightfold","truth_index":{"grade":"C","score":59,"open_postings":496,"ghost_share":0.429,"stale_share":0.25,"repost_share":0.591,"time_to_fill_p50_days":54,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Marketing","role_family":"Marketing","seniority":"junior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Lisbon, Portugal"],"countries":["PT"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Git","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Linux","optional":false},{"name":"LogRhythm","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Tanium","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"SQL","optional":true}],"status":"closed","first_seen_at":"2026-09-21T00:00:00Z","employer_posted_date":"2026-09-21","last_verified_at":"2026-10-12T00:01:13Z","board_verified":false,"closed_at":"2026-10-12T00:01:13Z","days_open":21,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":21},"description":"Join Us\nAt Vodafone, we’re not just shaping the future of connectivity for our customers - we’re shaping the future for everyone who joins our team. When you work with us, you’re part of a global mission to connect people, solve complex challenges, and create a sustainable and more inclusive world. If you want to grow your career whilst finding the perfect balance between work and life, Vodafone offers the opportunities to help you belong and make a real impact.\nThe SIEM Content Development Specialist plays a critical role in advancing the Cyber Security Operations Center’s ability to detect and respond to cybersecurity incidents. This role focuses on designing and developing cutting-edge detection content leveraging a wide array of security technologies and telemetry to identify malicious activity and guide security analysts through effective response playbooks.\nWorking within a threat-led framework, the specialist collaborates across teams to translate threat intelligence into actionable detection logic and response workflows. The position demands strong technical acumen, analytical thinking, and problem-solving capabilities, along with the ability to communicate clearly with peers, leadership, and cross-functional stakeholders.\nWhat you’ll do\nContribute to continuous improvement initiatives across multiple technologies and telecoms devices by developing and refining content that enhanced threat detection and response capabilities;\nContribute to the development and optimisation of threat detection content, including the tuning of threat and vulnerability management technologies and the continual refinement of SIEM rules and logic to enhance detection accuracy and operational performance;\nLead and contribute to the optimisation and modernisation of SIEM content, supporting the adoption of next-generation SIEM technologies and cloud-native security tools;\nManage the lifecycle of detection content, including development, testing, release, and retirement, using version control and documentation best practices;\nCollaborate with DevOps/SecOps teams to integrate security content into broader CI/CD workflows; Collaborate with the CSOC Manager to support improvements in security operations through effective content contributions;\nSupport security event analysis by participating in and may drive security event analysis activities to address current cyber threats;\nAssist in threat response activities, providing analytical input from a blue team perspective to help identify potential threat group behaviours;\nContribute to the creation of cyber security reports and advisories, ensuring timely and accurate dissemination to key stakeholders;\nParticipate in residual risk assessments, supporting post-incident analysis and the documentation of operational and technical lessons learned;\nCollaborating with data owners and customers on understanding data sources and use cases and successfully translating requirements to actionable content;\nTrack and report on the effectiveness of deployed content, using metrics and stakeholder feedback to drive improvements.\nWho you are\nBachelor/Master's Degree in related field; 3 years or above related experience;\nMinimum of 2-5 years’ experience in SIEM content (rule logic and code) development role;\nMinimum of 2 years of SOC analyst experience (Level2 or above) required;\nIn depth and extensive hands-on experience in security event analysis, create and refine SIEM/EDR rules and deliver efficiency within the SIEM and all other technologies used within the team;\nDemonstrate deep understanding of telecoms equipment, protocols, and network architecture to develop accurate and effective SIEM content;\nProven experience working with telecommunications network protocols (e.g. SS7, Diameter, GTP-C);\nDeep Knowledge of telecoms protocols and equipment (e.g., Routers, Switches, VoIP systems,IOT,NAS);\nDeep knowledge of networking protocols and addressing schemes, i.e., TCP/IP functions, CIDR blocks, subnets, addressing, communications, etc;\nDeep knowledge of Windows/Linux operating systems;\nExceptional working knowledge of security technologies such as SIEM (ArcSight, Sentinel, QRadar, LogRhythm, Splunk), EDR (Microsoft Defender, FireEye, Tanium), IDS/IPS, firewalls, proxies, web application firewalls, anti-virus, etc;\nUnderstanding of cloud and IoT security in telecoms;\nComprehensive understanding of Window Security Event logs and Syslog; Excellent familiarity with endpoint/perimeter security attack vectors and detection (blue/purple teaming);\nExcellent familiarity with standard security frameworks such as MITRE, cyber kill chain and APT campaign strategies;\nOutstanding knowledge of cloud platforms such as Azure, O365, Google cloud, AWS, Oracle;\nExperience with modern SIEM platforms, including cloud-native or hybrid solutions;\nHands-on experience with CI/CD pipelines and automation tools for security content deployment;\nProficiency in version control systems (e.g., Git) for managing SIEM content; Excellent working knowledge of regular expression development; Scripting and programming experience is highly desirable;\nKusto or SQL knowledge, including rule/query optimisation;\nProven ability to prioritise workload, meet deadlines and utilise time effectively; \nGood interpersonal and communication skills, works effectively as a team leader and the ability; \nExperience in security event analytics, for example Elastic, Azure Sentinel or Splunk;\nExcellent verbal and written communication skills;\nHighly disciplined and motivated, able to work independently or under direction; Deep understanding of threat actor techniques and tools; \nFluency in English.\nNot a perfect fit?\nWorried that you don’t meet all the desired criteria exactly? At Vodafone we are passionate about empowering people and creating a workplace where everyone can thrive, whatever their personal or professional background. If you’re excited about this role but your experience doesn’t align exactly with every part of the job description, we encourage you to still apply as you may be the right candidate for this role or another opportunity.\nWhat's in it for you\nHybrid Work Model - Flexible hybrid work model with 8-10 in-office days per month, managed by team leaders;\nVodafone Products and Services - Employees get a mobile phone, free communication plan, data card, and various discounts on services and products;\nRecognition - Recognition programs for innovative, creative, high-potential employees and exemplary behaviors; \nHealth and Well-being - Well-being Program offers nutrition and psychological consultations, webinars, workshops, and discounts on various services and products;\nLearning - Access to Communities of Practice and a customizable digital training platform with high-quality content (namely Harvard Business Publishing, Skillsoft and Speexx);\nLocal and International Mobility - Internal recruitment with local and international rotation opportunities across departments and roles.\nWho we are\nWe are a leading international Telco, serving millions of customers. At Vodafone, we believe that connectivity is a force for good. If we use it for the things that really matter, it can improve people's lives and the world around us. Through our technology we empower people, connecting everyone regardless of who they are or where they live and we protect the planet, whilst helping our customers do the same.\nBelonging at Vodafone isn't a concept; it's lived, breathed, and cultivated through everything we do. You'll be part of a global and diverse community, with many different minds, abilities, backgrounds and cultures. ;We're committed to increase diversity, ensure equal representation, and make Vodafone a place everyone feels safe, valued and included.\nIf you require any reasonable adjustments or have an accessibility request as part of your recruitment journey, for example, extended time or breaks in between online assessments, please refer to https://careers.vodafone.com/application-adjustments/ for guidance.\nTogether we can.","description_format":"text","description_chars":8034,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"Portugal","iso":"PT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Token Launch Platforms","Smartphones"],"lifecycle":[{"event":"open","at":"2026-09-24T14:28:55Z"},{"event":"close","at":"2026-10-03T18:32:10Z"},{"event":"reopen","at":"2026-10-03T18:32:12Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/vodacom-mozambique-siem-content-development-specialist","json_url":"https://alion.io/job/vodacom-mozambique-siem-content-development-specialist.json","meta":{"generated_at":"2026-10-19T08:57:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6145,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":51587},"rest":"https://alion.io/mcp/rest/get_company?id=51587"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvodacom-mozambique-siem-content-development-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvodacom-mozambique-siem-content-development-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvodacom-mozambique-siem-content-development-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/vodacom-mozambique-siem-content-development-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvodacom-mozambique-siem-content-development-specialist"}]}