Senior Microsoft Sentinel Engineer

About the role

A company is looking for a Senior Microsoft Sentinel Engineer with strong hands-on experience deploying, configuring and managing SIEM solutions in Microsoft Sentinel. The role covers end-to-end Sentinel implementation, including log onboarding, detection rules, dashboards, automation and ongoing optimisation. It suits a senior engineer who has worked in real production SOC environments and can lead Sentinel deployments independently.

Key responsibilities

• Design, deploy and manage Microsoft Sentinel environments
• Onboard log sources from Azure services, Microsoft Defender solutions, and on-premises servers, firewalls and security tools
• Configure and tune analytics rules, alerts and incidents, workbooks and dashboards
• Implement automation and response workflows using Logic Apps
• Reduce false positives and optimise alert quality
• Support SOC teams with investigation and threat-hunting use cases
• Troubleshoot data ingestion, connector and performance issues
• Prepare documentation, SOPs and operational guides, and conduct knowledge transfer and handover sessions
• Support POC, pilot and production rollouts

Required profile

• Strong hands-on experience with Microsoft Sentinel (SIEM)
• Experience onboarding logs via built-in connectors, Syslog, APIs and custom data connectors
• Knowledge of KQL (Kusto Query Language)
• Experience in SOC or security monitoring environments
• Understanding of SIEM concepts such as incidents, alerts, correlation and threat detection

Required skills

• Mandatory: Microsoft Sentinel, KQL, log onboarding via connectors, Syslog, APIs and custom connectors
• Preferred: Microsoft Defender (XDR integration), Azure Log Analytics, Microsoft Entra ID, networking and security logs, Azure infrastructure basics
• Preferred qualifications: Microsoft Security certifications (SC-200, AZ-500 or equivalent), experience with Microsoft partners or enterprise SOCs, knowledge of SOAR, automation or incident response playbooks