> Markdown version of [/jobs/ext/534717-it-security-engineer-purview-and-sentinel-lead-full-time-days-remote](https://www.wearedevelopers.com/jobs/ext/534717-it-security-engineer-purview-and-sentinel-lead-full-time-days-remote). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# IT Security Engineer - Purview and Sentinel Lead - Full Time, Days (Remote)

- **Company:** NOR HEALTHCARE SYSTEMS CORP
- **Location:** Bellflower, CA, United States (Remote available)
- **Experience:** Expert
- **Salary:** $135,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Cloud Computing Security, Cyber Security, Data Governance, Information Leak Prevention, Data Security, Intrusion Detection and Prevention, Microsoft Security Essentials, Windows PowerShell, Kusto Query Language, Security Information and Event Management, Microsoft Power Automate, Mitre Att&ck, Information Technology, Cybercrime, Microsoft Sentinel, Security Orchestration, Automation & Response
- **Published:** June 11, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=1550285ed950e206

## About the Role

Do you have experience in Threat hunting activities?, Do you have a Bachelor's degree?, * Experience: 2+ years in security operations, compliance engineering, or cloud security roles with direct hands-on experience in Microsoft Sentinel and/or Microsoft Purview

 * Education: Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or equivalent practical experience
 * Certifications (Required or Expected Within 12 Months):
 * Microsoft Security Operations Analyst Associate (SC-200)

Technical Skills:

 * Advanced KQL proficiency - analytic rules, hunting queries, workbooks, and summarization
 * Hands-on experience with Sentinel data connectors, DCRs, automation rules, and Logic Apps playbooks
 * Working knowledge of Microsoft Purview compliance portal: DLP, sensitivity labels, eDiscovery, litigation holds, and Audit
 * Familiarity with Microsoft Defender XDR suite integration (MDE, MDI, MDA, MDO)
 * Proficiency with PowerShell and Microsoft Graph API for compliance and security automation
 * Understanding of MITRE ATT&CK framework and its application to detection rule development

## Description

The Purview and Sentinel Lead serves as the organization's primary subject matter expert for Microsoft Purview (compliance, data governance, and eDiscovery) and Microsoft Sentinel (cloud-native SIEM/SOAR). This role is responsible for the design, operation, and continuous improvement of the organization's data protection posture and security operations detection capabilities across a multi-facility healthcare environment., * Microsoft Sentinel - SIEM/SOAR Operations: Own the architecture, configuration, and day-to-day health of the Microsoft Sentinel environment, including workspace design, data connector management, and cost optimization

 * Microsoft Purview - ComplianceData Governance: Design and administer the organization's Microsoft Purview compliance posture, including Information Protection, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, and Audit solutions
 * Detection EngineeringThreat Intelligence: Maintain a detection engineering lifecycle - ideate, build, validate, tune, and retire - for Sentinel analytic rules based on threat intelligence feeds (H-ISAC, MDTI, CISA advisories)
 * Governance, ReportingCollaboration: Produce regular operational metrics and executive-level reporting on SIEM alert volume, detection coverage, DLP policy effectiveness, and eDiscovery activity


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Web-based Information Visualization](https://www.wearedevelopers.com/videos/84-web-based-information-visualization)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)