Senior Microsoft Sentinel & Defender Security Engineer

EY

Edmonton

On-site

CAD 91,000 - 126,000

Full time

4 days ago

Be an early applicant

Application generator

Stand out for this role — generate a tailored resume and cover letter in about a minute.

Get past ATS filters

Job summary

EY is seeking a senior, hands-on Microsoft security engineer to design, implement and continuously improve our Managed Detection and Response services. You will work with clients and delivery teams to deploy Microsoft Sentinel, engineer detections, and build automations with Azure Logic Apps.

This role emphasizes deep engineering expertise, clear client communication and end-to-end ownership from design through production support, including multi-tenant onboarding and Defender/XDR integrations

Qualifications

Bachelor's degree or diploma in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
Typically, seven or more years of cybersecurity experience, including significant recent experience delivering Microsoft Sentinel and Defender engineering work.
Experience working in a client-facing consulting, MSSP, MDR, or enterprise security engineering role.
Microsoft Certified: Security Operations Analyst Associate (SC-200) is preferred. Azure, identity, architecture, or security certifications are considered an asset.
Experience with source control, infrastructure as code, CI/CD, or deployment automation for Microsoft Sentinel content is considered an asset.
Experience integrating Microsoft Sentinel with IT service management, threat intelligence, network security, identity, endpoint, email, or cloud platforms is considered an asset.

Responsibilities

Lead the technical design and implementation of Microsoft Sentinel SIEM and SOAR solutions for new and existing MDR clients.
Design workspace, data ingestion, retention, access-control, and multi-tenant operating models that account for security, regulatory, scalability, and cost requirements.
Configure Microsoft Sentinel in the Defender portal, Log Analytics workspaces, data connectors, diagnostic settings, content solutions, watchlists, and supporting Azure resources.
Detection engineering and threat analytics: create, test, tune, document, and maintain analytics rules, hunting queries, parsers, and functions using KQL.
Translate threat scenarios, intelligence, customer risks, and operational requirements into practical detection use cases mapped to MITRE ATT&CK.
Design and implement secure cross-tenant access using Azure Lighthouse and Entra B2B collaboration.
Lead technical workshops, gather requirements, explain design decisions, and provide clear recommendations to client security and technology stakeholders.
Provide technical guidance and peer review to engineers and analysts without direct people-management responsibility.