Cyber Security Engineer

Experis; Greater London; Hybrid; GBP 92,000 - 138,000; Full time

Job summary

Experis is partnering with a leading Microsoft Security Partner to deliver a major cyber security transformation for a large financial services organisation in London. We seek an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to own the platform, detections, and automation.

This hands-on role focuses on engineering, configuring, and optimising Sentinel, developing advanced KQL detections, integrating telemetry, and driving CI/CD for detections within a

Qualifications

• Hands-on experience implementing and optimising Microsoft Sentinel beyond SOC monitoring.
• Strong ability to develop complex KQL queries, analytics rules and detections.
• Experience designing and maintaining SIEM content and use cases.
• Practical exposure to Azure Monitor Agent, DCRs and Log Analytics.
• Experience integrating Defender XDR and other security technologies.
• Automation skills with Logic Apps, PowerShell or Python.
• Experience with MITRE ATT&CK coverage.
• Proficient in CI/CD for detections and telemetry.
• Familiarity with Git/GitHub and Azure DevOps.
• Experience in financial services or regulated environments.

Responsibilities

• Engineer, configure and optimise Microsoft Sentinel across a complex enterprise.
• Develop, test and maintain advanced KQL queries, rules and detections.
• Design and manage telemetry ingestion using AMA, DCRs and Log Analytics.
• Integrate Sentinel with Defender XDR, Entra ID and other sources.
• Develop automated security workflows using Logic Apps, Functions, PowerShell and API calls.
• Improve detection quality and reduce false positives using MITRE ATT&CK.
• Troubleshoot ingestion pipelines and SIEM integration issues.
• Optimize ingestion costs, retention and log filtering.
• Support continuous improvement of enterprise detection engineering.

Skills

Sentinel Engineering

Advanced KQL

Detection Engineering

Data Ingestion

Security Integrations

Automation

MITRE ATT&CK

CI/CD pipelines

Git/GitHub

Azure DevOps

Tools

Azure Monitor Agent

Data Collection Rules

Log Analytics

Custom connectors

Job description

Location: London (2 days onsite per week)

Day Rate: Competitive, dependent on experience

Duration: Initial contract with long-term extension potential

Start: ASAP

The Opportunity

We're partnering with a leading Microsoft Security Partner delivering a major cyber security transformation programme for a large enterprise organisation within the financial services sector.

We're looking for an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to help engineer, enhance and optimise enterprise security monitoring and detection capabilities.

This is a highly technical, hands-on engineering position requiring someone who can take ownership of both the Microsoft Sentinel platform and the detection content running within it.

This is not a traditional SOC Analyst role. We're specifically looking for engineers with proven experience building, configuring and optimising Microsoft Sentinel environments, developing sophisticated KQL detections and implementing security automation.

Key Responsibilities

• Engineer, configure and optimise Microsoft Sentinel across a complex enterprise environment.
• Develop, test and maintain advanced KQL queries, analytics rules, custom detections and correlation logic.
• Design and manage security telemetry ingestion using Azure Monitor Agent (AMA), Data Collection Rules (DCRs), Log Analytics and custom connectors.
• Integrate Microsoft Sentinel with Defender XDR, Entra ID, cloud workloads, endpoint security solutions and infrastructure logging sources.
• Develop and maintain automated security workflows using Azure Logic Apps, Azure Functions, PowerShell, Python and REST APIs.
• Improve detection quality, reduce false positives and enhance threat coverage using MITRE ATT&CK.
• Troubleshoot ingestion pipelines, platform performance and SIEM integration issues.
• Optimise ingestion costs, retention policies, log filtering and overall platform efficiency.
• Support continuous improvement of enterprise detection engineering capabilities.

Applicants must demonstrate hands-on commercial experience in the following areas:

• Microsoft Sentinel Engineering: Proven experience implementing, configuring, administering and optimising Sentinel environments, beyond day-to-day SOC monitoring.
• Advanced KQL: Strong ability to independently develop complex KQL queries, analytics rules and threat detection content.
• Detection Engineering: Experience designing, testing, tuning and maintaining custom SIEM detection rules and use cases.
• Data Ingestion: Practical experience with Azure Monitor Agent, Data Collection Rules, Log Analytics, data connectors or custom ingestion pipelines.
• Microsoft Security Integrations: Hands-on experience integrating security telemetry from Defender XDR and other enterprise security technologies.
• Security Automation: Experience developing or implementing automation using Logic Apps, PowerShell, Python, Azure Functions or APIs.
• Enterprise Security: Experience delivering security engineering solutions within complex enterprise environments.
• Detection-as-Code and CI/CD pipelines.
• Git, Azure DevOps or GitHub.
• Custom KQL parsers and advanced telemetry transformation.
• MITRE ATT&CK-based detection coverage.
• Financial services or other regulated environments.

Location: London, 2 days onsite per week

Start Date: ASAP

Contract Scope: Long-term programme with extension potential