Overview
A Security Engineer is sought to enhance a client's security tooling and logging infrastructure. This hands-on role integrates endpoint, Zscaler, and identity tooling with SIEM and logging using Microsoft Sentinel and Cribl, necessitating collaboration with various client teams to ensure effective security measures. The engineer will be responsible for configuring and managing these systems, ensuring reliable telemetry for optimal detection capabilities.
Responsibilities
- Deploy, configure, and tune endpoint security tooling, including policy management and agent rollout.
- Configure and manage Zscaler services, including policy, access controls, and traffic steering.
- Implement and support identity tooling, including authentication policy, conditional access, and privileged access controls.
- Build and maintain Microsoft Sentinel, including workspace configuration, data connectors, and analytics rules.
- Design and manage Cribl pipelines for routing, filtering, enrichment, and reduction of log data.
- Onboard new log sources from various tools, ensuring data is parsed and normalized for detection.
- Tune detections and manage data volume and cost without losing security visibility.
- Produce clear technical documentation, including designs, standards, and handover notes.
Requirements
- Hands-on experience with endpoint security tooling, Zscaler, and identity platforms in a production enterprise environment.
- Proficiency with Microsoft Sentinel and Cribl, including managing log sources.
- Ability to integrate security tools with a SIEM and troubleshoot data flow issues.
- Capacity to work independently and deliver results without close supervision.
- Strong communication skills, with the ability to explain technical issues clearly to clients.
- Relevant vendor or Microsoft security certification (e.g., SC-200, Zscaler, Cribl) preferred, though hands-on experience is prioritized.
- Experience with KQL, scripting, or automation is a plus.
- Familiarity with formal change governance and maintenance window processes is desirable.