Delivery Engineer – Microsoft Sentinel (SIEM/SOAR)

About the role

We are looking for a hands‑on Delivery Engineer with deep expertise in Microsoft Sentinel to design, implement and manage our security monitoring and response platform across Azure and Microsoft 365 environments.

Key responsibilities

• Design, deploy and administer Microsoft Sentinel, including data connectors, Log Analytics workspaces and Data Collection Rules.
• Develop and optimise analytics rules, hunting queries, workbooks and dashboards using Kusto Query Language (KQL).
• Create and maintain SOAR playbooks with Azure Logic Apps and Automation Rules.
• Integrate Sentinel with Microsoft Defender XDR services and a wide range of third‑party security products.
• Conduct threat hunting, incident investigation and response using Sentinel and UEBA capabilities.
• Align detection use cases with the MITRE ATT&CK framework and reduce false positives.
• Monitor SIEM health, log ingestion performance and platform costs.
• Produce technical documentation, runbooks and operational reports.

Required profile

• 3–8 years of experience in Security Operations or Security Engineering.
• At least 2 years of hands‑on Microsoft Sentinel implementation and administration.
• Proven experience in detection engineering, threat hunting and incident response.
• Strong knowledge of Azure RBAC, least‑privilege access and cost optimisation.

Required skills

• Microsoft Sentinel (SIEM/SOAR)
• Kusto Query Language (KQL)
• Azure Logic Apps, Azure Functions, Automation Rules
• Microsoft Defender XDR (Endpoint, Identity, Office 365, Cloud Apps, Cloud)
• ASIM normalization, Content Hub, custom parsers
• Syslog, CEF, Windows Events, REST API connectors, AMA Agent
• Integration with Palo Alto Networks, Fortinet, Cisco Secure Firewall/ISE, Check Point, CrowdStrike Falcon, Zscaler (ZIA/ZPA), Proofpoint, F5 BIG‑IP
• Integration of logs from AWS, GCP, firewalls, VPNs, IDS/IPS
• MITRE ATT&CK framework