SIEM Content and Platform Engineer – Hybrid (London office 1 day per month)
Full-time | Cyber Security | Hybrid, with one day a month in the London office
About the role
If you like building detection systems that analysts trust and a SIEM platform that scales, this role is for you. You will join the Cyber Security team to improve the Proactive Security monitoring capability, working with Security Operations, Infrastructure, Cloud and Application teams. You will be the subject matter expert for Microsoft Sentinel and detection engineering, delivering reliable telemetry, high-fidelity detections and secure integrations across a large enterprise.
What you’ll be doing
- Design, test, deploy and tune analytics rules, correlation logic and hunting queries aligned with MITRE ATT&CK
- Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations
- Set logging standards, onboarding patterns and governance for the detection engineering lifecycle
- Automate security workflows with Logic Apps, Azure Functions, REST APIs, PowerShell and Python
- Build Sentinel workbooks, platform health monitoring and KPI/KRI reporting for the Proactive Security function
- Lead platform enhancements, proofs of concept, migrations and upgrades, and support critical incidents and major changes
What we’re looking for
- Proven SIEM, detection or security platform engineering experience in a large enterprise (essential)
- Strong hands-on Microsoft Sentinel and Defender XDR experience across Endpoint, Identity and Cloud, including advanced KQL (essential)
- Experience onboarding infrastructure, cloud, application and security telemetry, with Azure Monitor Agent, Azure Arc and Log Analytics
- Experience with Detection-as-Code, including CI/CD, source control and peer review, plus Windows Event Forwarding, Sysmon and PowerShell logging
- Practical security engineering skills: platform hardening, vulnerability remediation, technical risk assessment and control validation
- Clear communication with technical and management stakeholders, calm delivery under pressure, and willingness to provide planned out-of-hours support for critical upgrades and major changes
- Desirable: SC-200 or AZ-500, plus Cribl experience
What you get
- Hands-on work with Azure technologies and cloud transformation projects
- Competitive compensation
- Career growth opportunities
- Access to continuous learning and certifications
- The chance to work on impactful cloud initiatives across various industries
- Hybrid working, with just one day a month in the London office
This role suits
A detection or platform engineer who enjoys treating security monitoring as an engineering discipline, with version control, peer review and measurable quality.
#J-18808-Ljbffr
SIEM Engineer in London employer: Myn
Myn is an exceptional employer, offering a nurturing and supportive work environment for Nursery Room Leaders in Bristol. With generous benefits such as 33 days of annual leave, flexible working options, and extensive family and wellbeing support, employees are encouraged to thrive both personally and professionally. The company prioritises employee growth through tailored training and progression opportunities, making it a rewarding place to build a meaningful career in early years education.
