We’re currently looking for an experienced SIEM Content & Platform Engineer to join a Cyber Security team.
Location: London (2 days per week onsite, remainder remote)
Duration: Initial 5 Month Contract
Rate: £550
IR35: Outside IR35
Start Date: ASAP
The Role:
You will act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture and associated security platforms.
Key Responsibilities:
- Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms
- Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK
- Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations
- Develop logging standards, onboarding patterns, use-case documentation and governance for the detection engineering lifecycle
- Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell and Python
- Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation and security control validation
- Support integration and engineering of endpoint, identity, cloud, network and infrastructure security controls with the SIEM and Defender ecosystem
- Build Sentinel Workbooks, platform health monitoring and KPI/KRI reporting
- Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures and support documentation
- Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting and technical support during critical incidents and major changes
- Proven experience in SIEM, detection or security platform engineering within a large enterprise environment
- Strong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity and Cloud
- Experience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation and contextual enrichment
- Experience onboarding infrastructure, cloud, application and security telemetry into a SIEM
- Practical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment and security control validation
- Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting and operational support
- Experience applying Detection-as-Code, CI/CD, source control and peer-review practices
Technical Skills:
- Microsoft Sentinel
- Identity
- Cloud
- KQL
- Analytics Rules
- Hunting
- Workbooks
- Playbooks
- Data Collection Rules
- Custom Tables
- Parsers
- Custom Ingestion
- Windows Event Forwarding and Collection
- XPath Filtering
- Windows Event IDs
- Sysmon
- PowerShell Logging
- Logic Apps
- REST APIs
- PowerShell
- Python
- MITRE ATT&CK
- Detection Coverage Analysis
- Git-Based CI/CD
- Cribl
Soft Skills:
- Proactive, accountable and delivery-focused approach
- Strong analytical, troubleshooting and problem-solving capability
- Clear communication with technical, operational and management stakeholders
- Effective collaboration across teams, regions and technical disciplines
- Calm, structured delivery under pressure, with disciplined documentation and prioritisation
- Willingness to provide planned out-of-hours support for critical upgrades and major changes when required
Qualifications:
- Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering or a related discipline
- SC-200 or AZ-500 desirable
- Additional cloud, SIEM, security engineering or automation certifications advantageous
#J-18808-Ljbffr
SIEM Content & Platform Engineer (Contract) in London employer: Curo Services
Join a forward-thinking cyber security business that values innovation and collaboration, offering you the chance to make a significant impact in a newly created Senior Security Operations Engineer role. With a strong focus on employee growth and a supportive remote work culture, you'll have access to competitive benefits and the opportunity to shape the future of security operations while working alongside experienced professionals. This is an excellent employer for those looking to drive meaningful change in a dynamic environment.
