Security Operations Centre Engineer - Microsoft Sentinel

KEY RESPONSIBILITIES: • Microsoft Sentinel Operations: Manage and maintain the Microsoft Sentinel platform, ensuring optimal performance and availability for the security operations team. • Log Source Onboarding: Onboard and troubleshoot log sources (on-premises and cloud) to the Sentinel platform using syslog, APIs, and other mechanisms. Ensure data integrity, reliability, and proper formatting. • Incident Response Support: Collaborate with the Security Operations Center (SOC) to develop and refine detection rules, alerts, and responses to security incidents. • KQL Development: Create and maintain complex use cases using Kusto Query Language (KQL) to detect security threats and anomalies across the organization. • Custom Analytics and Detection Rules: Design and implement custom analytics rules, playbooks, and alerts to improve threat detection and response capabilities. • SIEM Migration: Participate in or lead SIEM migration projects, ensuring smooth transition and minimal disruption to security operations. • Playbook Development: Develop and maintain security playbooks for automated response actions, leveraging SOAR capabilities within Microsoft Sentinel. • Performance Monitoring: Monitor and troubleshoot performance issues related to Microsoft Sentinel, ensuring the platform scales and adapts to the evolving security landscape. • Security Data Integration: Integrate Sentinel with other security tools (e.g., XDR, Azure services, firewalls) for enhanced threat visibility and correlation. • SOC Use Case Collaboration: Collaborate with security teams to gather business requirements and develop SOC use cases that address the organization’s security needs. • Content Optimization: Update and fine-tune KQL-based analytical rules and content based on feedback from security analysts, ensuring reduced false positives and improved detection accuracy. REQUIRED SKILLS, EXPERIENCES AND QUALIFICATIONS: • Experience: 5+ years of experience in SIEM operations, with at least 2 years focused on Microsoft Sentinel or similar cloud-native SIEM platforms. • Technical Expertise: Proficiency in Kusto Query Language (KQL) and developing custom detection rules and dashboards within Microsoft Sentinel. • Cloud Security: Strong understanding of Microsoft Azure security services, including Defender for Cloud (Azure Security Center), Microsoft Entra ID (Azure Active Directory), and Azure Key Vault. • Incident Response: Experience supporting incident response processes, designing playbooks, and integrating SOAR functionalities. • Log Management: Hands-on experience with log collection, parsing, and analysis from various sources (e.g., firewalls, endpoints, cloud environments). • SIEM Migration: Proven experience in SIEM migration projects and transitioning between platforms. • DevOps Knowledge: Understanding of DevOps practices such as CICD pipelines, GIT, ARM templates, and Azure Automation for streamlining processes. • Problem Solving: Strong troubleshooting skills with the ability to identify and resolve performance or integration issues within Microsoft Sentinel.