> Markdown version of [/jobs/ext/2409770-security-engineer-microsoft-sentinel-defender-xdr-various-levels](https://www.wearedevelopers.com/jobs/ext/2409770-security-engineer-microsoft-sentinel-defender-xdr-various-levels). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer - Microsoft Sentinel & Defender XDR (Various levels)

- **Company:** Netbuilder
- **Location:** London, UK
- **Contract:** Temporary contract
- **Skills:** Cyber Security, Intrusion Detection and Prevention, Python (Programming Language), Microsoft Security Essentials, Windows PowerShell, Kusto Query Language, Security Log, Data Logging, Scripting, Data Ingestion, Mitre Att&ck, Microsoft InTune, Cybercrime, Microsoft Sentinel, Unified Endpoint Management
- **Published:** August 26, 2026
- **Apply:** https://uk.indeed.com/viewjob?jk=ca138e7125ad7f94

## About the Role

* Experience in Detection Engineering, Security Engineering, SOC Engineering, Threat Detection or a related cybersecurity role
 * Hands-on experience with Microsoft Sentinel and Microsoft Defender XDR and Endpoint configuration via Intune
 * Strong understanding of Security log pipelines and log ingestion technology (ideally Cribl)
 * Experience tuning detections, reducing false positives and improving detection coverage
 * Experience using KQL and scripting (PowerShell or Python)
 * Good understanding of threat detection methodologies, including MITRE ATT&CK
 * Working knowledge of security logging configuration
 * Ability to work collaboratively across cyber security, technology and operational teams
 * A proactive mindset, ability to communicate effectively, comfortable with self-directed and collaborative working
 * Experience working in a client-facing, consulting or managed services environment would be advantageous

## Description

We're hiring for experienced Security Engineers (various levels) to join our Security and Observability practice, working across a range of global client environments.

You'll be responsible for developing and enhancing detection capabilities across modern Microsoft security platforms, using Microsoft Sentinel, Defender XDR and KQL to develop, test and optimise effective detection logic.

The roles combine hands-on engineering with problem-solving and collaboration. You'll work with security teams to identify gaps, investigate detection challenges, improve existing use cases and develop new capabilities in response to changing threats and operational requirements.

If you enjoy getting into the detail of security data, writing detection logic and continuously finding ways to make detection capabilities more effective, we'd like to hear from you.

What you'll be doing:

 * Develop, test and maintain detection rules across Microsoft Sentinel and Defender XDR
 * Write and optimise KQL queries to identify suspicious activity and security events
 * Analyse telemetry and investigate gaps in data quality, coverage and detection capability
 * Translate threat intelligence and security requirements into practical detection use cases
 * Work with SOC, Threat Hunting and Incident Response teams to improve detection outcomes
 * Use PowerShell or Python to automate repetitive tasks and enhance detection workflows
 * Contribute to the ongoing development of detection engineering standards and best practices


## Related Videos

- [Building Security Champions](https://www.wearedevelopers.com/videos/193-building-security-champions)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [GenAI Is a Junior Dev With Root Access](https://www.wearedevelopers.com/videos/100191-genai-is-a-junior-dev-with-root-access)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Software Engineer Salary London](https://www.wearedevelopers.com/magazine/252-software-engineer-salary-london)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)