Job Description
We're looking for a hands-on Microsoft Sentinel engineer to get security data flowing reliably into Sentinel on a large Microsoft cloud security modernisation programme.
You'll connect data sources, configure Azure Monitor Agent and Data Collection Rules, and fix ingestion problems across several Azure environments. The aim is security telemetry that is complete, trustworthy and easy to support once you hand it over.
This is an engineering role, not a SOC analyst or Microsoft 365 admin role. We need someone who has built and troubleshot Sentinel ingestion themselves, ideally in multi-tenant or MSSP-style environments.
What you'll be doing
Configuring and troubleshooting Microsoft Sentinel data connectors
Setting up Azure Monitor Agent (AMA) and Data Collection Rules (DCRs)
Building and fixing security log-routing and ingestion pipelines
Writing and adapting KQL queries to validate ingestion and diagnose problems
Making parsing and normalisation changes where needed
Testing data completeness, quality and ingestion latency
Finding and fixing failed, incomplete or unreliable data feeds
Monitoring connector health and improving reliability
Onboarding and stabilising security data across multiple Azure environments
Writing configuration, testing and operational support documentation
By the end of the engagement you'll have delivered working connectors, validated data flows with test evidence, a connector health baseline, and documentation the support team can run with.
What you'll bring
Strong hands-on Microsoft Sentinel engineering experience
Practical experience configuring and troubleshooting Sentinel data connectors
In-depth knowledge of Azure Monitor Agent and Data Collection Rules
Good working knowledge of KQL
Experience with security log pipelines, ingestion, parsing and normalisation
Experience testing and validating security telemetry
Strong integration and troubleshooting skills
A solid understanding of Azure security and SOC/SIEM environments
Nice to have
Microsoft Defender products (Defender XDR, Defender for Endpoint, Defender for Cloud)
Azure Monitor and Log Analytics
Microsoft Entra ID and Microsoft 365 security data
Syslog/CEF ingestion
Windows Security Events
Custom log and API-based ingestion
SIEM migration or consolidation projects
Multi-tenant or MSSP-style Sentinel environments
ASAP - End of March
Hiring: Security Monitoring Specialist in Sunderland employer: Xcede
As a Mobility Engineer/Consultant with us, you'll thrive in a dynamic remote work environment that champions innovation and collaboration. We offer competitive benefits, a strong focus on employee development, and the opportunity to work on cutting-edge enterprise solutions that make a real impact. Join our team and be part of a culture that values your expertise and encourages professional growth while ensuring you have the tools and support needed to excel in your role.
