Senior Microsoft Sentinel Engineer / Architect at Granular Tek

Job description

Serve as the technical engineering lead for designing, implementing, optimizing and automating enterprise security solutions built on Microsoft Sentinel, Azure security, Microsoft Defender and Microsoft Purview. You will own SIEM/SOAR architecture, detection engineering, threat hunting and security automation, partnering with Security Operations, Cloud Engineering, Infrastructure and DevSecOps teams to establish an automation-first security operating model across a complex, multi-vendor environment. • Lead Microsoft Sentinel architecture, deployment, data onboarding, normalization and optimization • Build advanced KQL detections, analytics rules, hunting queries, workbooks and dashboards • Develop SOAR capabilities with automation rules, Logic Apps and Azure Functions • Integrate Sentinel with Microsoft and third-party platforms via REST APIs, webhooks and connectors • Engineer Azure security across Defender for Cloud, Azure Policy, Entra ID, Conditional Access and Key Vault • Implement and administer Microsoft Purview DLP, sensitivity labels, insider risk and auditing • Automate manual, repetitive security processes end to end • Manage security infrastructure and content with Terraform, Bicep or ARM templates • Apply Git, CI/CD, peer review and automated testing to security content • Support incident investigations, threat hunting, intrusion analysis and incident response • Establish standards for SIEM/SOAR, detection engineering, logging and cloud security • Mentor security engineers and provide technical guidance

Requirements

Must-haves

Lead Microsoft Sentinel architecture, deployment, data onboarding, normalization and optimization
Build advanced KQL detections, analytics rules, hunting queries, workbooks and dashboards
Develop SOAR capabilities with automation rules, Logic Apps and Azure Functions
Integrate Sentinel with Microsoft and third-party platforms via REST APIs, webhooks and connectors
Engineer Azure security across Defender for Cloud, Azure Policy, Entra ID, Conditional Access and Key Vault
Implement and administer Microsoft Purview DLP, sensitivity labels, insider risk and auditing
Automate manual, repetitive security processes end to end
Manage security infrastructure and content with Terraform, Bicep or ARM templates
Apply Git, CI/CD, peer review and automated testing to security content
Support incident investigations, threat hunting, intrusion analysis and incident response
Establish standards for SIEM/SOAR, detection engineering, logging and cloud security
Mentor security engineers and provide technical guidance

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

azurerestci/cd

Platform: careers-html
Effort: medium