Security Content Specialist

Role overview

State Street is hiring a Security Content Specialist to help build, test, improve, and document threat detection content that supports cyber security validation. The role contributes to a proactive, threat-intelligence-led operating model designed to safeguard the organisation, its clients, and its partners against sophisticated global threat actors. Remote working may be available for very strong candidates.

What you will do

• Support the introduction of new detection content and rules, while watching for overlap and reducing duplicate detections.
• Help organise and track bug fixes and related issues.
• Work with Security Content Engineers to test and fine-tune threat detection scenarios across SIEM and EDR platforms.
• Keep SIEM lookup tables and related data sources current so they do not become outdated.
• Review existing content performance, efficiency, and potential retirement candidates.
• Record and verify testing evidence in Confluence before moving content into production.
• Create and maintain reusable assets, scripts, and procedures used to validate SIEM and EDR rules.
• Coordinate with Threat Intelligence teams to align detection strategy with the threat model and MITRE ATT&CK framework.
• Collaborate with purple teams and other security, risk, IT, and business stakeholders to confirm and document detection objectives.
• Contribute to alert development across controls such as EDR, IDS, cloud platforms, and email gateways, and provide analysis and recommendations.
• Maintain documentation covering other IT teams' processes, naming standards, and privileged accounts.
• Manage Jira tickets in an agile workflow and keep process documentation updated in Confluence.

What the role values

• Experience working in an agile development lifecycle.
• Strong emphasis on accurate documentation and end-to-end lifecycle tracking.
• Hands-on experience testing, tuning, and validating detection alerts and reports.
• Understanding of adversary tactics, techniques, and procedures, with the ability to translate them into detective controls.
• Working knowledge of cyber threat intelligence.
• Familiarity with IT architecture and operations, including compute, networks, storage, and cloud.
• Awareness of security control technologies.

Education and experience

• Bachelor's degree in Cyber Security, Information Technology, Computer Science, or equivalent relevant experience.
• More than 3 years of experience in a cyber security-related role such as SIEM/EDR Content Engineer, Incident Response, SOC Tier 3 Analyst, Threat Hunter, or Penetration Tester.

Additional requirements

• Background in financial services is an added advantage.
• Software development or scripting knowledge is beneficial, including PERL, Python, and PowerShell.
• Technical security certifications such as GMON, GCDA, or GCIH are a plus.

About State Street

State Street supports institutional investors worldwide by helping them manage risk, respond to changing conditions, and improve performance and profitability. The company values employees who are engaged, collaborative, and committed to client success. It also offers inclusive growth opportunities, flexible support for work and life, paid volunteer time, and employee networks.

Equal opportunity

State Street is an equal opportunity employer and reviews all qualified candidates without discrimination based on race, creed, colour, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military or veteran status, or other protected characteristics under applicable law.

Job reference

Job ID: R-793846