Security Engineer - Microsoft Sentinel & Defender XDR (Various levels)

We’re hiring for experienced Security Engineers (various levels) to join our Security and Observability practice, working across a range of global client environments.

You’ll be responsible for developing and enhancing detection capabilities across modern Microsoft security platforms, using Microsoft Sentinel, Defender XDR and KQL to develop, test and optimise effective detection logic.

The roles combine hands-on engineering with problem-solving and collaboration. You’ll work with security teams to identify gaps, investigate detection challenges, improve existing use cases and develop new capabilities in response to changing threats and operational requirements.

If you enjoy getting into the detail of security data, writing detection logic and continuously finding ways to make detection capabilities more effective, we’d like to hear from you.

What you’ll be doing:

• Develop, test and maintain detection rules across Microsoft Sentinel and Defender XDR
• Write and optimise KQL queries to identify suspicious activity and security events
• Analyse telemetry and investigate gaps in data quality, coverage and detection capability
• Translate threat intelligence and security requirements into practical detection use cases
• Work with SOC, Threat Hunting and Incident Response teams to improve detection outcomes
• Use PowerShell or Python to automate repetitive tasks and enhance detection workflows
• Contribute to the ongoing development of detection engineering standards and best practices

• Experience in Detection Engineering, Security Engineering, SOC Engineering, Threat Detection or a related cybersecurity role
• Hands-on experience with Microsoft Sentinel and Microsoft Defender XDR and Endpoint configuration via Intune
• Strong understanding of Security log pipelines and log ingestion technology (ideally Cribl)
• Experience tuning detections, reducing false positives and improving detection coverage
• Experience using KQL and scripting (PowerShell or Python)
• Good understanding of threat detection methodologies, including MITRE ATT&CK
• Working knowledge of security logging configuration
• Ability to work collaboratively across cyber security, technology and operational teams
• A proactive mindset, ability to communicate effectively, comfortable with self-directed and collaborative working
• Experience working in a client-facing, consulting or managed services environment would be advantageous