SIEM Content & Platform Engineer (Contract)

We’re currently looking for an experienced SIEM Content & Platform Engineer to join a Cyber Security team.

Location: London (2 days per week onsite, remainder remote)Duration: Initial 5 Month ContractRate: £550IR35: Outside IR35Start Date: ASAP

The Role:You will act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture and associated security platforms.

Key Responsibilities:

• Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms




• Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK




• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations




• Develop logging standards, onboarding patterns, use-case documentation and governance for the detection engineering lifecycle




• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell and Python




• Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation and security control validation




• Support integration and engineering of endpoint, identity, cloud, network and infrastructure security controls with the SIEM and Defender ecosystem




• Build Sentinel Workbooks, platform health monitoring and KPI/KRI reporting




• Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures and support documentation




• Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting and technical support during critical incidents and major changes




• Proven experience in SIEM, detection or security platform engineering within a large enterprise environment




• Strong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity and Cloud




• Experience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation and contextual enrichment




• Experience onboarding infrastructure, cloud, application and security telemetry into a SIEM




• Practical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment and security control validation




• Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting and operational support




• Experience applying Detection-as-Code, CI/CD, source control and peer-review practices

Technical Skills:

• Microsoft Sentinel




• Identity




• Cloud




• KQL




• Analytics Rules




• Hunting




• Workbooks




• Playbooks




• Data Collection Rules




• Custom Tables




• Parsers




• Custom Ingestion




• Windows Event Forwarding and Collection




• XPath Filtering




• Windows Event IDs




• Sysmon




• PowerShell Logging




• Logic Apps




• REST APIs




• PowerShell




• Python




• MITRE ATT&CK




• Detection Coverage Analysis




• Git-Based CI/CD




• Cribl

Soft Skills:

• Proactive, accountable and delivery-focused approach




• Strong analytical, troubleshooting and problem-solving capability




• Clear communication with technical, operational and management stakeholders




• Effective collaboration across teams, regions and technical disciplines




• Calm, structured delivery under pressure, with disciplined documentation and prioritisation




• Willingness to provide planned out-of-hours support for critical upgrades and major changes when required

Qualifications:

• Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering or a related discipline




• SC-200 or AZ-500 desirable




• Additional cloud, SIEM, security engineering or automation certifications advantageous

#J-18808-Ljbffr…