Detection Engineer: Master Microsoft Sentinel & Defender XDR

Aviva; Bristol; On-site; GBP 39,000 - 65,000; Full time

Benefits offered by this job

Bonus: 10% of annual salary

Generous pension—Aviva contributes up,

Private medical benefit

Employee share plan (Matching Shares)

Volunteer days

Job summary

Aviva is seeking a Cyber Security Detection Engineer in Bristol. You’ll design, build and tune detections in Microsoft Sentinel and Defender XDR to improve visibility, coverage and response to threats.

You’ll work closely with SOC, Threat Hunting and Incident Response, turning data into actionable protection while focusing on telemetry quality and scalable detection workflows. Remote/hybrid options available in a flexible security team.

Qualifications

• Hands‑on experience creating and tuning detections in Microsoft Sentinel and Defender XDR.
• Strong understanding of log pipelines, schema mapping and telemetry quality (e.g. ASIM).
• Experience using KQL and scripting (PowerShell or Python) to automate and improve detection workflows.
• Ability to work collaboratively across cyber security, technology and operational teams.
• A proactive mindset, with a focus on improving coverage, quality and efficiency in detection engineering.

Responsibilities

• Design, build and tune detections in Microsoft Sentinel and Defender XDR.
• Strengthen detection coverage and response across Aviva’s environment.
• Collaborate with SOC, Threat Hunting and Incident Response teams to ensure telemetry reliability and logging standards.

Skills

Microsoft Sentinel detections

Microsoft Defender XDR

KQL

PowerShell

Python

Telemetry quality

Tools

PowerShell

Python

KQL

Job description

Aviva is seeking a Cyber Security Detection Engineer in Bristol. You’ll design, build and tune detections in Microsoft Sentinel and Defender XDR to improve visibility, coverage and response to threats.

You’ll work closely with SOC, Threat Hunting and Incident Response, turning data into actionable protection while focusing on telemetry quality and scalable detection workflows. Remote/hybrid options available in a flexible security team.