218636-en_GB
Life on the team
Join a highly skilled Cyber Engineering team focused on building and enhancing modern security operations capabilities across a global enterprise environment. You will work at the intersection of security engineering, cloud technologies, SIEM operations, automation, and AI-driven security innovation, helping to protect critical business services through scalable and resilient security solutions.
This role offers the opportunity to work with industry-leading technologies including Microsoft Sentinel, Microsoft XDR, Microsoft Defender for Cloud, Azure, Cribl, Logic Apps, and Azure DevOps. You'll collaborate with security analysts, cloud engineers, infrastructure teams, architects, and platform specialists to design and deliver security capabilities that improve visibility, strengthen detection coverage, and drive operational efficiency.
We are looking for someone who enjoys solving complex technical challenges, automating repetitive tasks, and continuously improving security platforms through engineering excellence and innovation.
What you’ll do
Security Platform Engineering
- Engineer, configure, and maintain Microsoft Sentinel and associated Microsoft security solutions.
- Design and implement scalable logging architectures and telemetry ingestion patterns.
- Onboard and integrate new log sources into Sentinel, Cribl, and related security platforms.
- Improve security visibility across cloud, infrastructure, endpoint, and third-party solutions.
Detection Engineering & Threat Monitoring
- Develop, optimize, and maintain security detections using Kusto Query Language (KQL).
- Enhance detection coverage and reduce false positives through continuous tuning.
- Support threat hunting activities and use case development aligned to emerging threats.
- Contribute to detection engineering standards, documentation, and best practices.
Security Automation & SOAR
- Design and implement automation workflows using Logic Apps and related technologies.
- Identify opportunities to automate manual security operations and improve response efficiency.
- Develop reusable scripts, integrations, and engineering solutions using PowerShell and APIs.
- Support the adoption of AI-assisted and agentic AI capabilities within security operations.
SIEM & Data Pipeline Management
- Support and optimize SIEM data ingestion, retention, performance, and cost efficiency.
- Troubleshoot data pipeline issues, parsing challenges, and ingestion failures.
- Manage integrations between Cribl, Microsoft Sentinel, and enterprise data sources.
- Monitor platform health and support operational reporting and governance activities.
Cloud Security & Platform Integration
- Support Microsoft Defender for Cloud and Azure security capabilities.
- Integrate cloud, SaaS, infrastructure, and application audit logs into security platforms.
- Work with technical teams to improve telemetry quality and security monitoring coverage.
- Troubleshoot and resolve complex platform, integration, and automation issues.
Infrastructure as Code & DevOps
- Develop and maintain Sentinel as Code and Infrastructure-as-Code deployments.
- Support CI/CD processes using Azure DevOps.
- Create and maintain ARM templates, Bicep, JSON, and PowerShell assets.
- Contribute to deployment standards, documentation, and continuous improvement initiatives.
What you’ll need
Essential Skills & Experience
- 8 to 12 years overall experience in Cyber security and 5+ years of hands-on experience in SIEM engineering, Microsoft Sentinel expertise, KQL skills, and hands-on Microsoft Security experience are mandatory.
- Hands-on experience with one or more Microsoft security technologies such as:
- Microsoft Sentinel
- Microsoft XDR
- Microsoft Defender for Cloud
- Azure Monitor / Log Analytics
- Strong understanding of Kusto Query Language (KQL) for detections, investigations, and reporting.
- Experience with automation and scripting using PowerShell, Logic Apps, APIs, or workflow orchestration tools.
- Good understanding of Azure, networking, cloud technologies, identity management, and Windows/Linux operating systems.
- Proven ability to troubleshoot technical issues across security platforms, data pipelines, and integrations.
- Experience working with source control, documentation standards, and change management processes.
Desirable Skills
- Cribl administration, pipeline development, or log routing experience.
- Sentinel as Code and Infrastructure-as-Code experience.
- Azure DevOps and CI/CD pipeline implementation experience.
- Threat hunting and advanced detection engineering knowledge.
- Experience integrating third-party SaaS, cloud, or infrastructure audit logs into SIEM platforms.
- Exposure to large enterprise or managed security service environments.
- Interest in leveraging AI and automation to improve security operations.
Personal Attributes
- Strong analytical and problem-solving skills.
- Passion for automation and continuous improvement.
- Engineering-first mindset with a focus on scalability and efficiency.
- Effective communicator with strong documentation skills.
- Collaborative team player who can work across security, cloud, infrastructure, and operations teams.
- Self-motivated learner with a desire to expand expertise across modern security technologies.
