WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Back

Microsoft Sentinel SME

LAMBENTWIT TECHNOLOGIES, INC.
United States
18 days ago
Apply on www.indeed.com
Prepare application

Role details

Contract type
Permanent contract
Employment type
Full-time (> 32 hours)
Experience level
Expert
Experience required
5 years minimum
Compensation
$166,400.0 - $208,000.0
Working hours
Regular working hours
Job source
www.indeed.com

Tech stack

Data Analysis Application Firewall Audit Trail Automation of Tests Microsoft Azure Cloud Computing Cloud Computing Security Cloud Engineering Cyber Security Continuous Integration Information Leak Prevention Data Security
+39 more
File System Permissions Github Identity and Access Management Intrusion Detection and Prevention Python (Programming Language) Network Security Microsoft Security Essentials Microsoft Office Windows PowerShell Role-Based Access Control Azure Active Directory Kusto Query Language Zero Trust Network Access Security Information and Event Management Systems Integration Software Vulnerability Management EndPointSecurity Data Logging Scripting Data Ingestion Microsoft Power Automate Mitre Att&ck Firewalls (Computer Science) Git Web Filtering Cybercrime Bicep Microsoft Sentinel Enterprise Integration Firewall Services Module Restful APIs Terraform Webhooks Software Version Control Devsecops Serverless Computing Security Orchestration, Automation & Response Key Vault Vulnerability Analysis

Job description

  • Serve as the senior technical lead and architect for Microsoft Sentinel, including workspace architecture, deployment, configuration, data onboarding, normalization, analytics, monitoring, and optimization.
  • Design and develop advanced Microsoft Sentinel detection capabilities using KQL, including custom analytics rules, scheduled queries, threat hunting queries, workbooks, dashboards, and security content.
  • Develop and maintain SOAR capabilitiesusing Sentinel automation rules, Logic Apps, Azure Functions, and other automation technologies to streamline incident detection, investigation, enrichment, and response.
  • Integrate Sentinel with Microsoft and third-party security platforms using REST APIs, webhooks, connectors, custom integrations, and automated workflows.
  • Engineer security solutions acrossMicrosoft Azure, including Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, logging, monitoring, and identity security.
  • Implement and administer Microsoft Purview, including Data Loss Prevention (DLP), sensitivity labels, information protection, insider risk management, auditing, and compliance-related security controls.
  • Identify manual and repetitive security processes and design end-to-end automation that improves operational efficiency, consistency, scalability, and response times.
  • Develop and maintain security infrastructure and content usingInfrastructure as Code, including Terraform, Bicep, or ARM templates.
  • Implement security engineering practices through Git, Azure DevOps, or GitHub, including version control, peer review, automated testing, and CI/CD pipelines for security content and automation.
  • Support security incident investigations, threat hunting, intrusion analysis, vulnerability management, and incident responseacross cloud, network, endpoint, identity, and application environments.
  • Review security controls and monitoring capabilities to identify gaps, improve detection coverage, reduce false positives, and strengthen protection against advanced cyber threats.
  • Establish engineering standards and best practices for SIEM/SOAR architecture, detection engineering, security automation, logging, and cloud security.
  • Collaborate with Security Operations teams to improve incident triage, investigation workflows, response automation, and security operations metrics.
  • Provide technical guidance and mentorship to security engineers and other technical teams.

Requirements

  • 10+ years of experience as a Cloud Security Engineer, Information Security Engineer, Security Architect, or DevSecOps Engineer.
  • 5+ years of hands-on Microsoft Sentinel engineering and architecture experience, including:
  • Sentinel workspace deployment and architecture
  • Data source onboarding and normalization
  • Custom analytics rules
  • KQL development
  • Threat hunting
  • Workbooks and dashboards
  • Automation rules
  • SOAR playbooks
  • Advanced proficiency with Kusto Query Language (KQL) for detection engineering, threat hunting, investigation, analytics, and workbook development.
  • Strong hands-on experience securingMicrosoft Azure environments, including:
  • Microsoft Defender for Cloud
  • Azure Policy
  • Microsoft Entra ID
  • Conditional Access
  • Azure networking/security controls
  • Key Vault
  • Azure logging and monitoring
  • Hands-on experience implementing and administering Microsoft Purview, including:
  • DLP policies
  • Sensitivity labels
  • Information Protection
  • Insider Risk Management
  • Audit and compliance capabilities
  • Demonstrated experience identifying manual, repeatable security processes and automating them end to endacross Microsoft and non-Microsoft security platforms.
  • Experience integrating security platforms through REST APIs, webhooks, connectors, and custom automation.
  • Strong scripting and development skills with Python and PowerShell.
  • Hands-on experience with Azure Logic Apps and Azure Functions.
  • Experience with Infrastructure as Code, including Terraform, Bicep, and/or ARM.
  • Experience managing security automation and content through Git, Azure DevOps, GitHub, and CI/CD pipelines.
  • 5+ years of experience with network, cloud, and computer system security, including:
  • User access controls
  • RBAC
  • SSO
  • File permissions
  • Firewall policies
  • Audit logging
  • Network security controls
  • 5+ years of experience with enterprise security technologies, including:
  • SIEM/SOAR
  • Firewalls
  • Intrusion Detection/Prevention Systems
  • Endpoint Protection
  • Web Application Firewalls
  • Vulnerability Scanning
  • Data Loss Prevention
  • Log Management
  • Content Filtering
  • 5+ years of experience developing and deploying security solutions designed to defend against advanced cyber threats.
  • 5+ years of experience reviewing, monitoring, and troubleshooting security systems to ensure security controls are operating effectively.
  • 5+ years of experience investigating security incidents and intrusions, conducting technical investigations, performing threat analysis, and supporting incident response., * Microsoft security certifications such asSC-200, SC-100, AZ-500, or related certifications.
  • Experience with Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, and Defender for Office 365.
  • Experience integrating Microsoft Sentinel with third-party SIEM, SOAR, EDR, IAM, vulnerability management, and network security platforms.
  • Experience with MITRE ATT&CK, threat modeling, detection-as-code, and security content lifecycle management.
  • Experience operating security platforms in large-scale enterprise or regulated environments.
  • Strong understanding of Zero Trust architecture, identity security, cloud security, and modern SOC operations.
  • Strong communication skills with the ability to translate security requirements into scalable technical solutions.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.indeed.com
Prepare application

Good distractions

Loading talks and stories from around this role…