Senior Microsoft Sentinel / SIEM Engineer

This is a standout opportunity for a Microsoft Sentinel expert to step into a high-impact, technically advanced role with a global security Microsoft powerhouse.

You will be joining a Microsoft managed global partner, a prominent MISA member, a team with Security MVPs and a Microsoft Verified Safe XDR Solution Partner, and a trusted Security Depth Partner. This gives you unparalleled access to Microsoft’s security product roadmap, security previews, and frontline support.

You will work at the sharp end of cyber defence, directly contributing to investigations involving nation-state threat actors while refining your craft across enterprise-scale log ingestion and customised Sentinel integration engineering.

The Role:

• Own and optimise enterprise-wide log onboarding into Microsoft Sentinel – deploying standard and custom connectors, Function Apps, and parsers to build tailored SIEM solutions that drive real-world threat detection and response.
• Log ingestion at scale across numerous hybrid and multi-cloud environments.
• Enhance custom Function Apps and ingestion pipelines.
• Parse, normalise, and optimise log telemetry to ensure precision and cost control.
• Partner with IR teams on real attacks – tuning rules against live threat actor activity.
• Sync closely with Microsoft teams to build cutting-edge detection capabilities.
• Contribute to internal knowledge base and help shape engineering standards.

What’s needed?

• Experience building and integrating complex Microsoft Sentinel at SMC and enterprise level.
• Understanding of security telemetry across identity, endpoint, cloud, and network layers.
• Experience in SIEM content development, including KQL, analytics rules, and custom data connectors.
• Scripting and engineering skills – Python, PowerShell, APIs, Function Apps.
• A background in cyber threat detection, incident response or DFIR is a real plus.
• Comfortable working in very fast-moving, customer-facing delivery environments.

The Technical Shizzle:

• Microsoft Sentinel (KQL, Analytics Rules, Workbooks, Watchlists).
• Azure Function Apps, Logic Apps, ARM templates.
• PowerShell, Python, REST APIs.
• Log ingestion and parsing across multi platforms (Azure/AWS/GCP, M365, Defender, Entra, Copilot, Carbon Black, Okta + Tier 1 Network vendors).
• MITRE ATT&CK, threat detection frameworks, IOC enrichment.
• Ability to go and work things out is crucial.
• Sentinel/Log Analytics Cost Management and Data Optimisation.

What’s In It for You?

• Direct access to Microsoft Sentinel product teams and early feature previews.
• Deep involvement in real-world nation-state attack detection.
• Huge opportunity to stretch and sharpen your Sentinel mastery.
• Be part of a Microsoft Security elite MISA and Depth partner.
• Exposure to multi-cloud detection and advanced security automation.
• Fully remote, highly flexible work culture with global team collaboration.
• Recognition, career progression and growth all within a global Microsoft specialist and respected security consultancy.