Microsoft Security Consultant

Integrity360; City Of London; In loco; GBP 70.000 - 110.000; Tempo pieno

Descrizione del lavoro

Integrity360, a leading cybersecurity specialist, seeks a Microsoft Security Engineer for its Professional Services team. You will onboard clients to the MSSP service with Microsoft Sentinel at the center, configuring workspaces, connectors and data ingestion, and producing design and runbooks for handover.

You’ll collaborate with clients, architects and SOC teams to ensure secure deployments, including Defender XDR workloads, delivering repeatable patterns and documentation across

Competenze

• Hands-on experience deploying, configuring or supporting Microsoft Sentinel in production or customer environments.
• Practical knowledge of Sentinel data connectors, Log Analytics workspaces, Azure Monitor Agent, Data Collection Rules, syslog and CEF collection patterns.
• Strong Kusto Query Language (KQL) skills for data validation, troubleshooting and detection tuning.
• Experience onboarding and troubleshooting log sources across Microsoft 365, Azure, endpoints, identity, network and third-party platforms.
• Understanding ingestion filtering, data transformation, parsing, normalization and telemetry cost implications.
• Ability to produce clear technical designs and delivery documentation (HLDs, implementation plans, runbooks).
• Working knowledge of Defender XDR integrations with Sentinel.
• Familiarity with SIEM operations and incident workflows.

Mansioni

• Deliver end-to-end onboarding of client Sentinel environments into the MSSP service.
• Configure Sentinel workspaces, content solutions, data connectors, analytics rules and related components.
• Run technical discovery sessions to identify log sources, connectivity requirements and data volumes.
• Onboard log sources using supported methods (Azure Monitor Agent, APIs, syslog, CEF).
• Design data filtering and transformation to improve signal quality and control costs.
• Validate data ingestion, parsing, and troubleshooting across source systems.
• Tune analytics rules and incident generation to balance coverage and noise.
• Onboard Defender XDR workloads (Endpoint, Identity, Office 365, Cloud Apps).
• Produce high-level designs, implementation plans and handover documentation.
• Coordinate with clients, architects and SOC teams for risk and readiness.
• Apply engineering standards and contribute to templates and patterns.
• Support onboarding and early-life support.
• Occasional travel as required.

Conoscenze

Sentinel deployment

KQL queries

Azure Monitor

SIEM operations

Log onboarding

Security engineering

Client-facing

Azure Defender

Strumenti

Azure Sentinel

Azure Monitor

Data Collection Rules

CEF collection

Azure DevOps

PowerShell

Terraform

Bicep/ARM

Descrizione del lavoro

About Us

Integrity360 is a leading independent cybersecurity and PCI specialist operating across Europe, Africa, the Caribbean, and North America. The company has office locations in Ireland, the UK, Bulgaria, Italy, Sweden, Spain, Lithuania, Ukraine, Africa, the Caribbean, and Canada, supported by eight Security Operations Centres (SOCs) located in Dublin, Sofia, Madrid, Stockholm, Paris, Rome, Johannesburg and Cape Town.

With over 900 employees, including more than 600 dedicated cybersecurity professionals, Integrity360 delivers a full suite of professional, support, and managed security services. These span the complete cyber risk lifecycle, from identification and prevention to detection, response, and recovery. Integrity360 supports over 3000 mid-market and enterprise organisations across sectors including financial services, insurance, government, healthcare, retail, telecommunications, and utilities.

At Integrity360, people come first. We invest heavily in learning, development and progression, fostering a dynamic culture where innovation, collaboration and continuous growth are at the heart of what we do. If you're ready to take your cyber security career to the next level, we’d love to hear from you.

Job Role / Responsibilities

As a Microsoft Security Engineer, you will be responsible for onboarding clients to our managed security service, with Microsoft Sentinel at the centre of the solution. You will configure and integrate Sentinel environments, onboard and validate log sources, and prepare each deployment for effective monitoring and operational handover to the Security Operations Centre.

Your primary focus will be the technical delivery of new Microsoft Sentinel onboardings. This includes workspace and connector configuration, data collection design, log-source integration, ingestion filtering, validation, detection tuning and the production of high-level design and implementation documentation. You will work closely with clients, architects and SOC teams to ensure each deployment is supportable, secure and aligned with the contracted service scope.

The role also requires hands-on experience, or a clear ability to develop quickly, in onboarding Microsoft Defender XDR workloads such as Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud Apps. You will help establish the integrations, policies and operational workflows required to provide joined-up detection and response across the Microsoft security ecosystem.

This is a client-facing engineering role within Professional Services, reporting to the Head of Cloud Security & Microsoft Security Services. You will manage assigned onboarding activities from discovery and design through implementation, testing, documentation and handover. You will be supported by an experienced team and have access to training and certification opportunities across Microsoft security technologies.

Key Responsibilities

• Deliver end-to-end onboarding of client Microsoft Sentinel environments into the MSSP service.
• Configure Sentinel workspaces, content solutions, data connectors, analytics rules, automation rules, watchlists, workbooks and related components in accordance with approved designs and service standards.
• Run technical discovery sessions to identify log sources, connectivity requirements, data volumes, retention needs, dependencies and onboarding priorities.
• Onboard Microsoft, third-party, cloud, network, identity and application log sources using supported collection methods, including Azure Monitor Agent, Data Collection Rules, APIs, syslog, CEF and custom connectors where appropriate.
• Design and implement data filtering and transformation to improve signal quality, control ingestion costs and ensure the service receives the telemetry required for monitoring and detection.
• Validate data ingestion, parsing, field mapping, timestamps, health and coverage, and troubleshoot issues across source systems, collectors, networks and Azure services.
• Tune analytics rules, alert logic and incident generation in collaboration with SOC and detection engineering teams to reduce unnecessary noise while maintaining appropriate coverage.
• Onboard and integrate Microsoft Defender XDR workloads, including Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud Apps.
• Produce accurate high-level designs, implementation plans, configuration records, test evidence, operational runbooks and handover documentation.
• Coordinate with clients, project managers, architects, SOC analysts and service teams to manage dependencies, risks, actions and readiness for service transition.
• Apply repeatable engineering standards, peer review and change control, and contribute improvements to onboarding templates, technical patterns and internal procedures.
• Support troubleshooting and remediation during onboarding and early-life support, escalating product or service dependencies where required.
• Undertake occasional travel where required to support client delivery.

Essential

• Hands-on experience deploying, configuring or supporting Microsoft Sentinel in production or customer environments.
• Practical knowledge of Sentinel data connectors, Log Analytics workspaces, Azure Monitor Agent, Data Collection Rules, syslog and CEF collection patterns.
• Strong Kusto Query Language skills for data validation, troubleshooting, investigation and detection tuning.
• Experience onboarding and troubleshooting log sources across Microsoft 365, Azure, endpoints, identity, network, security and third-party platforms.
• Understanding of ingestion filtering, data transformation, parsing, normalisation, retention and the cost implications of security telemetry.
• Experience creating clear technical designs and delivery documentation, including HLDs, implementation plans, test records and operational handover materials.
• Working knowledge of Microsoft Defender XDR and the integration of its workloads with Microsoft Sentinel.
• Sound understanding of SIEM operations, detection engineering principles, incident workflows and the requirements of a managed security service.
• Strong troubleshooting skills across Azure, APIs, identity, networking and data collection components.
• Confident written and verbal communication skills, with the ability to work directly with technical and non-technical client stakeholders.
• Ability to manage assigned work independently while collaborating effectively with project, architecture, SOC and service teams.

Desired

• Experience working for an MSSP, MDR provider, Security Operations Centre or security-focused professional services team.
• Development of custom log parsers, KQL functions, ASIM-compatible content or other normalisation patterns for non-standard data sources.
• Experience with DevOps pipelines and source control for Microsoft Sentinel content, configuration and deployment.
• Practical knowledge of detection as code, including versioning, testing, peer review and controlled promotion of analytics content between environments.
• Experience with infrastructure as code and automation using technologies such as Bicep, ARM templates, Terraform, PowerShell, Azure CLI, Logic Apps or APIs.
• Knowledge of Microsoft Sentinel repositories, content management and repeatable multi-customer deployment patterns.
• Experience integrating Microsoft security services across tenants, subscriptions or delegated administration models such as Azure Lighthouse.
• Familiarity with MITRE ATT&CK and its application to detection coverage and use-case mapping.
  

Desired Qualifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500/SC-500).
• Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• Relevant Microsoft Applied Skills covering Sentinel, Defender XDR, security operations or automation.
• Other relevant security or cloud certifications are beneficial but not essential.

#LI-JL1