Content Engineer

Location: Milpitas, CA
Work Model: Onsite 4 days/week; flexible when needed
Employment Type: Contract-to-Hire

Non-Negotiable Skills

• EDR Policy & Configuration
• Microsoft Defender XDR
• CrowdStrike Falcon
• SOAR & Automation

Role Overview

We are seeking a Content Engineer to support the security operations function with a strong focus on hands-on configuration and tuning of security platforms. The role will work across Microsoft Defender, Microsoft 365 security configurations, CrowdStrike, and Sublime Security to align security controls with corporate policies and reduce organizational risk.

The ideal candidate will have strong automation skills to streamline content deployment, reduce manual effort, and maintain consistency across security platforms. The role will also involve reviewing control coverage, identifying gaps, and implementing remediation to strengthen the overall security posture.

Key Responsibilities / Skills

• SIEM / Detection Engineering
• KQL, SPL, YARA-L, Sigma
• Detection logic design, false-positive tuning, detection-as-code
• MITRE ATT&CK mapping and coverage gap analysis
• Log source onboarding, parsing, normalization, and field mapping
• Alert triage pipeline design, enrichment, severity, and suppression
• EDR Policy & Configuration
• Microsoft Defender XDR, ASR rules, tamper protection, exclusions, custom detections
• CrowdStrike Falcon, prevention policies, sensor grouping, IOA rules, Fusion SOAR, RTR
• EDR exclusion governance and endpoint telemetry tuning
• DNS Security
• Infoblox BloxOne
• Cloudflare Gateway
• DNS threat analysis including DGA, DNS tunneling, and beaconing
• Email Security
• Sublime Security
• Microsoft Defender for Office 365
• Proofpoint / Mimecast
• SPF/DKIM/DMARC and email header analysis
• SOAR & Automation
• Microsoft Sentinel Playbooks / Logic Apps
• VirusTotal, Shodan, WHOIS, and threat-intelligence API integrations
• ServiceNow / Jira workflow automation
• Python / PowerShell scripting
• Threat Intelligence
• MISP, OpenCTI, Anomali, Recorded Future
• IOC lifecycle management
• Intel-to-detection pipelines