SIEM Content Engineer –Sentinel – London – £550–£700 per day – 5 Months – Hybrid / 2 Days p/w in London
We are seeking an experienced SIEM Content Engineer to join a Cyber Security team on an initial 5-month contract. This is an excellent opportunity for a technically strong security engineer with expertise in Microsoft Sentinel, detection engineering and security platform development to play a key role in strengthening enterprise security monitoring and cyber resilience.
You will be responsible for developing high-quality detection content, engineering SIEM integrations, optimising security telemetry and implementing automation to improve threat detection and response capabilities across a complex enterprise environment.
Working closely with Security Operations, Cloud, Infrastructure and Application teams, you will help deliver scalable, reliable and effective security monitoring solutions.
Key Responsibilities
- Act as a subject matter expert across Microsoft Sentinel, detection engineering and security monitoring platforms.
- Design, develop, test and optimise analytics rules, correlation logic, threat-hunting queries and detection content aligned with the MITRE ATT&CK framework.
- Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API integrations.
- Develop logging standards, onboarding processes, detection use cases and governance frameworks.
- Develop Sentinel Workbooks, dashboards, platform health monitoring and KPI/KRI reporting.
- Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures and technical documentation.
- Apply Detection-as-Code, CI/CD, source control and peer-review practices to improve the quality and consistency of detection engineering.
- Provide technical support during critical incidents and major platform changes.
Essential Skills & Experience
- Proven experience in SIEM engineering, detection engineering or security platform engineering within a large enterprise environment.
- Strong hands-on expertise with Microsoft Sentinel, including administration, architecture, KQL, analytics rules, threat hunting, workbooks, watchlists and playbooks.
- Experience with Microsoft Defender XDR, particularly Defender for Endpoint, Identity and Cloud.
- Strong knowledge of detection development, threat hunting, cross-data correlation, contextual enrichment and detection coverage analysis.
- Experience onboarding cloud, infrastructure, application and security telemetry into SIEM platforms.
- Practical experience with Azure Monitor Agent, Azure Arc, Data Collection Rules, Log Analytics, custom tables and custom ingestion.
- Knowledge of Windows Event Forwarding, Windows Event IDs, Sysmon, XPath filtering and PowerShell logging.
- Experience developing security automation using REST APIs, Azure Functions, Logic Apps, PowerShell and Python.
Desirable Qualifications
- Microsoft security certifications such as SC-200 or AZ-500.
- Additional qualifications in cloud security, SIEM engineering, security automation or related disciplines.
- Experience delivering security engineering improvements across complex, hybrid enterprise environments.
#J-18808-Ljbffr…