Microsoft Sentinel Security Engineer

Your main job will be building and improving Microsoft Sentinel. Some clients are starting from scratch and others already have Sentinel in place but need it tidied up, so you could be doing a fresh deployment one month and reworking someone else’s setup the next. Either way, the aim is the same: get the right data in, write detections that pick up genuine threats, cut down the noise for analysts and automate the routine work.

You’ll work with our Azure engineers and the client’s security operations team. They’ll rely on you as the Sentinel specialist, so you’ll need to be confident making recommendations and explaining your reasoning. The work is in secure environments, so attention to detail and a careful approach are important., * Deploy and configure Microsoft Sentinel workspaces, including data connectors, permissions and retention settings

• Onboard log sources from Azure, Microsoft 365, Entra ID, on-premise servers, firewalls and third-party tools
• Build custom parsers and data transformations where logs don’t arrive in a usable format
• Write and maintain analytic rules in KQL, and tune them over time to reduce false positives
• Review existing detections, remove ones that aren’t adding value, and fill gaps in coverage
• Map detections to MITRE ATT&CK so it’s clear what threats are covered and what’s missing
• Build playbooks in Logic Apps to automate responses such as enriching alerts, notifying teams or isolating accounts
• Connect Sentinel with Microsoft Defender XDR, Defender for Cloud and other security tools in use
• Manage Sentinel content through CI/CD pipelines in Azure DevOps or GitHub, so changes are tracked and deployed consistently
• Build workbooks and dashboards that give analysts and senior stakeholders a clear picture of what’s happening
• Support analysts during threat hunts and incident investigations, and turn what’s learned into better detections
• Keep an eye on data ingestion costs, and adjust what’s collected and how long it’s kept
• Write and update runbooks, playbooks and handover documents for the SOC

• Active SC or DV security clearance
• Sole UK national, because of the security level of the work
• At least 2 years of hands-on experience engineering and administering Microsoft Sentinel
• Strong KQL skills, including writing efficient queries and detection logic
• Experience onboarding and normalising logs from a range of sources
• Experience building automation with Logic Apps or Sentinel playbooks
• A good working knowledge of Azure, Entra ID and the Microsoft Defender products
• A solid understanding of security monitoring, threat detection and incident response
• Able to explain security issues clearly to people who aren’t security specialists

It would also help if you have:

• A Microsoft certification such as SC-200 (Security Operations Analyst) or AZ-500 (Azure Security Engineer)
• Experience with other SIEM tools, such as Splunk
• Experience deploying Sentinel with infrastructure as code (Terraform, Bicep or ARM templates)
• Scripting experience in PowerShell or Python
• Previous work on UK government, defence or critical national infrastructure projects