Microsoft Security (Sentinel) Automation & Detection Engineer

Hays.; Cambridge; On-site; GBP 50,000 - 90,000; Full time

Job summary

An innovative multinational semiconductor and software design company is on the lookout for a Security Automation & Detection Engineer. In this dynamic role, you'll leverage your expertise in security operations and automation to enhance the efficiency of Cyber Defence Operations. With a focus on building robust SIEM detections and automating workflows, you'll work closely with analysts and third-party vendors to ensure seamless integration and operational excellence. This exciting opportunity offers a hybrid work environment, allowing you to contribute to cutting-edge security solutions while enjoying flexibility. If you're passionate about cybersecurity and eager to make a significant impact, this role is for you!

Qualifications

• 3+ years in cybersecurity with a focus on security operations and automation.
• Proficient in integrating security tools and automating workflows.

Responsibilities

• Build security automations and SIEM detections to enhance Cyber Defence Operations.
• Collaborate to streamline incident response and threat hunting processes.

Skills

Cybersecurity

Automation

Incident Response

Detection Engineering

Scripting (Python, PowerShell)

Cloud Security (Azure, AWS, Google Cloud)

Tools

SOAR platforms

SIEM

EDR

Microsoft Sentinel

Case Management tools

Job description

A multinational semiconductor and software design company is seeking a Security Automation & Detection Engineer for a 6-month contract to start ASAP, based in Cambridge (Hybrid), Inside IR35.

Role Overview:
Utilising knowledge of security operations, incident response, and detection engineering, you will be responsible for the delivery of SIEM detections and security automations.

The successful candidate will be proficient in automation and orchestration tools (e.g., SOAR platforms, scripting languages like Python, PowerShell) and have experience with integrating security tools (e.g., SIEM, EDR, firewalls) APIs, and Case Management tools for data enrichment.

Responsibilities:

1. Build security automations, logging, and SIEM detections to improve the Cyber Defence Operation's efficiency, scalability, and incident response capabilities.
2. Design, implement, and maintain automated workflows and playbooks to streamline CDO operations, including incident response, threat hunting, cyber threat intelligence, and vulnerability management.
3. Collaborate with Cyber Defence Operation analysts to identify repetitive tasks and automate them to improve operational efficiency.
4. Collaborate with Threat Intelligence, Incident Response, and Attack Surface Management to build and tune robust SIEM detections for both proactive and reactive response actions.
5. Continuously evaluate automation solutions for performance, reliability, and scalability, making improvements as necessary.
6. Collaborate with third-party vendors and service providers to leverage automation opportunities and ensure successful integrations.
7. Lead technical migration of log sources into Microsoft Sentinel SIEM.

Required Skills and Experience:

1. Demonstrated ability in cybersecurity, with at least 3 years in a technical role in security operations and/or security software development.
2. Solid understanding of security operations, automation standard processes, detection engineering, and SIEM management.
3. Experience with cloud security tools and platforms (e.g., Azure, AWS, Google Cloud) and their integration into SOC operations.
4. Vendor-specific certifications for Security orchestration, automation, and response (SOAR) platforms (e.g., Sentinel SOAR, Splunk SOAR, Palo Alto Cortex XSOAR).
5. Experience contributing to large-scale, sprint-based security automation and detection engineering projects.

Desirable Skills and Experience:

1. Ability to develop and implement long-term automation strategies aligned with security operation objectives.
2. Ability to translate technical concepts into clear, actionable insights for technical and non-technical partners.
3. Meticulous focus on ensuring accuracy, reliability, and security in automation workflows.
4. Consistent record of implementing automation and integration solutions in a SOC or similar environment.

#4661481 - Karl Randall