Microsoft Azure Cloud Sentinel Engineer (SME)

Client is seeking an experienced Microsoft Sentinel SME to focus on SIEM/SOAR engineering, Azure security telemetry architecture, and automated incident response. The engineer will be responsible for managing and separating security telemetry across on-premises and Azure cloud environments while developing automated response playbooks., * Design and implement Microsoft Sentinel SIEM/SOAR solutions.

• Architect and manage security telemetry segregation between on-premises and Azure cloud environments.
• Develop, modify, and maintain automated incident response playbooks using Azure Logic Apps.
• Create custom KQL queries, analytics rules, and detection logic.
• Integrate Microsoft Sentinel with ServiceNow and Microsoft Defender XDR.
• Support security monitoring, data ingestion, and parsing through Azure Log Analytics.
• Participate in Agile ceremonies, sprint planning, backlog management, and delivery activities.

1. Microsoft Sentinel & Logic Apps SOAR Engineering * Strong hands-on experience with Microsoft Sentinel SIEM/SOAR. * Building custom KQL analytics and detection rules. * Designing and developing automated incident response playbooks using Azure Logic Apps. * Integrating Microsoft Sentinel with ServiceNow and Microsoft Defender XDR.

2. Hybrid Cloud Security Telemetry Architecture * Hands-on experience with security telemetry architecture across on-premises and Azure cloud environments. * Designing and implementing separate monitoring and ingestion strategies for on-premises and cloud security data. * Ingesting, parsing, and managing security data streams in Azure Log Analytics.

3. Agile / Scrum Delivery * Experience working in an Agile/Scrum environment. * Managing sprint backlogs, assigned tasks, and delivery priorities. * Supporting continuous deployment and iterative engineering workflows., * 5 7+ years of hands-on experience in Microsoft Sentinel and Azure Security engineering. * Strong expertise in KQL, Microsoft Sentinel, and Azure Logic Apps. * Practical experience developing SOAR playbooks and automated incident response workflows. * Experience with hybrid cloud security telemetry architecture. * Integration experience with ServiceNow and Microsoft Defender XDR. * Prior Agile/Scrum delivery experience. * Must be a U.S. Citizen. * Must be able to pass an EFTPS (Electronic Federal Tax Payment System) background check.

Preferred Qualifications Microsoft or industry-recognized security certifications are strongly preferred:

• Microsoft SC-200
• Microsoft AZ-500
• Microsoft SC-100
• CISSP

Out of Scope Do Not Screen For

• Terraform
• Infrastructure as Code (IaC)
• Jira

ServiceNow is the primary ITSM platform for this engagement. Recruiter Screening Priority: Focus on candidates with hands-on Microsoft Sentinel engineering, custom KQL development, Azure Logic Apps SOAR playbooks, and hybrid cloud telemetry architecture. Do not shortlist candidates whose experience is limited to Sentinel monitoring or alert triage without engineering and implementation experience.