Overview
We are seeking a skilled Cyber Security Engineer with expertise in Microsoft Sentinel to lead the engineering and optimization of security monitoring capabilities for a major financial services transformation program. This technical position requires hands-on experience in building and enhancing Sentinel environments, as well as developing complex detection content. The chosen candidate will work closely with a leading Microsoft Security Partner on a long-term project.
Responsibilities
- Engineer, configure and optimise Microsoft Sentinel across a complex enterprise environment.
- Develop, test and maintain advanced KQL queries, analytics rules, custom detections and correlation logic.
- Design and manage security telemetry ingestion using Azure Monitor Agent, Data Collection Rules, Log Analytics and custom connectors.
- Integrate Microsoft Sentinel with Defender XDR, Entra ID, cloud workloads, endpoint security solutions and infrastructure logging sources.
- Develop and maintain automated security workflows using Azure Logic Apps, Azure Functions, PowerShell, Python and REST APIs.
- Improve detection quality, reduce false positives and enhance threat coverage using MITRE ATT&CK.
- Troubleshoot ingestion pipelines, platform performance and SIEM integration issues.
- Optimise ingestion costs, retention policies, log filtering and overall platform efficiency.
Requirements
- Proven experience implementing, configuring, administering and optimising Microsoft Sentinel environments.
- Strong ability to independently develop complex KQL queries, analytics rules and threat detection content.
- Experience designing, testing, tuning and maintaining custom SIEM detection rules and use cases.
- Practical experience with Azure Monitor Agent, Data Collection Rules, Log Analytics or custom ingestion pipelines.
- Hands-on experience integrating security telemetry from Defender XDR and other enterprise security technologies.
- Experience developing or implementing automation using Logic Apps, PowerShell, Python, Azure Functions or APIs.
- Experience delivering security engineering solutions within complex enterprise environments.
- Knowledge of Detection-as-Code, CI/CD pipelines, and security best practices in financial services or regulated environments.