Location: London (2 days onsite per week)
Day Rate: Competitive, dependent on experience
Duration: Initial contract with long-term extension potential
Start: ASAP
The Opportunity
We're partnering with a leading Microsoft Security Partner delivering a major cyber security transformation programme for a large enterprise organisation within the financial services sector.
We're looking for an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to help engineer, enhance and optimise enterprise security monitoring and detection capabilities.
This is a highly technical, hands-on engineering position requiring someone who can take ownership of both the Microsoft Sentinel platform and the detection content running within it.
This is not a traditional SOC Analyst role. We're specifically looking for engineers with proven experience building, configuring and optimising Microsoft Sentinel environments, developing sophisticated KQL detections and implementing security automation.
Key Responsibilities
- Engineer, configure and optimise Microsoft Sentinel across a complex enterprise environment.
- Develop, test and maintain advanced KQL queries, analytics rules, custom detections and correlation logic.
- Design and manage security telemetry ingestion using Azure Monitor Agent (AMA), Data Collection Rules (DCRs), Log Analytics and custom connectors.
- Integrate Microsoft Sentinel with Defender XDR, Entra ID, cloud workloads, endpoint security solutions and infrastructure logging sources.
- Develop and maintain automated security workflows using Azure Logic Apps, Azure Functions, PowerShell, Python and REST APIs.
- Improve detection quality, reduce false positives and enhance threat coverage using MITRE ATT&CK.
- Troubleshoot ingestion pipelines, platform performance and SIEM integration issues.
- Optimise ingestion costs, retention policies, log filtering and overall platform efficiency.
- Support continuous improvement of enterprise detection engineering capabilities.
Applicants must demonstrate hands-on commercial experience in the following areas:
- Microsoft Sentinel Engineering: Proven experience implementing, configuring, administering and optimising Sentinel environments, beyond day-to-day SOC monitoring.
- Advanced KQL: Strong ability to independently develop complex KQL queries, analytics rules and threat detection content.
- Detection Engineering: Experience designing, testing, tuning and maintaining custom SIEM detection rules and use cases.
- Data Ingestion: Practical experience with Azure Monitor Agent, Data Collection Rules, Log Analytics, data connectors or custom ingestion pipelines.
- Microsoft Security Integrations: Hands-on experience integrating security telemetry from Defender XDR and other enterprise security technologies.
- Security Automation: Experience developing or implementing automation using Logic Apps, PowerShell, Python, Azure Functions or APIs.
- Enterprise Security: Experience delivering security engineering solutions within complex enterprise environments.
- Detection-as-Code and CI/CD pipelines.
- Git, Azure DevOps or GitHub.
- Custom KQL parsers and advanced telemetry transformation.
- MITRE ATT&CK-based detection coverage.
- Financial services or other regulated environments.
Location: London, 2 days onsite per week
Start Date: ASAP
Contract Scope: Long-term programme with extension potential
Cyber Security Engineer in London employer: Experis Austria
Experis Austria is an exceptional employer, offering a dynamic work culture that fosters collaboration and innovation in the heart of London. With a focus on employee growth, we provide ample opportunities for professional development and skill enhancement, ensuring that our team members thrive in their careers while contributing to impactful projects in the oil and gas sector. Our hybrid work model promotes a healthy work-life balance, making it an ideal environment for those seeking meaningful and rewarding employment.
