Senior Microsoft Sentinel Engineer / Architect

What the role needs

• Lead Microsoft Sentinel architecture, deployment, data onboarding, normalization and optimization
• Build advanced KQL detections, analytics rules, hunting queries, workbooks and dashboards
• Develop SOAR capabilities with automation rules, Logic Apps and Azure Functions
• Integrate Sentinel with Microsoft and third-party platforms via REST APIs, webhooks and connectors
• Engineer Azure security across Defender for Cloud, Azure Policy, Entra ID, Conditional Access and Key Vault
• Implement and administer Microsoft Purview DLP, sensitivity labels, insider risk and auditing
• Automate manual, repetitive security processes end to end
• Manage security infrastructure and content with Terraform, Bicep or ARM templates
• Apply Git, CI/CD, peer review and automated testing to security content
• Support incident investigations, threat hunting, intrusion analysis and incident response
• Establish standards for SIEM/SOAR, detection engineering, logging and cloud security
• Mentor security engineers and provide technical guidance

From the employer

Serve as the technical engineering lead for designing, implementing, optimizing and automating enterprise security solutions built on Microsoft Sentinel, Azure security, Microsoft Defender and Microsoft Purview. You will own SIEM/SOAR architecture, detection engineering, threat hunting and security automation, partnering with Security Operations, Cloud Engineering, Infrastructure and DevSecOps teams to establish an automation-first security operating model across a complex, multi-vendor environment. • Lead Microsoft Sentinel architecture, deployment, data onboarding, normalization and optimization • Build advanced KQL detections, analytics rules, hunting queries, workbooks and dashboards • Develop SOAR capabilities with automation rules, Logic Apps and Azure Functions • Integrate Sentinel with Microsoft and third-party platforms via REST APIs, webhooks and connectors • Engineer Azure security across Defender for Cloud, Azure Policy, Entra ID, Conditional Access and Key Vault • Implement and administer Microsoft Purview DLP, sensitivity labels, insider risk and auditing • Automate manual, repetitive security processes end to end • Manage security infrastructure and content with Terraform, Bicep or ARM templates • Apply Git, CI/CD, peer review and automated testing to security content • Support incident investigations, threat hunting, intrusion analysis and incident response • Establish standards for SIEM/SOAR, detection engineering, logging and cloud security • Mentor security engineers and provide technical guidance