OT SIEM Engineer

Sword Group; Glasgow; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Personalised Career Development

Flexible working

Excellent benefits package

Job summary

Sword Group is seeking an OT SIEM Engineer to strengthen cyber security monitoring across complex OT environments, with a focus on Microsoft Sentinel. The role involves implementing automation, integrating telemetry and developing detection content to improve security operations.

You will collaborate with Cyber Defence and Security Operations teams, migrate data from LogRhythm, and contribute to threat hunting within Critical National Infrastructure contexts.

Qualifications

• Hands-on SIEM engineering experience.
• Onboarding log sources and integrating security telemetry.
• Strong understanding of log parsing, normalization and event correlation.
• Experience with KQL or similar SIEM query languages.
• Security monitoring, incident response and threat hunting knowledge.
• Familiarity with automation such as Logic Apps or SOAR.
• Proficiency with Git and CI/CD tooling.
• Analytical and problem-solving skills.
• Ability to work independently and with teams.
• Excellent communication with stakeholders.

Responsibilities

• As onboard and integrate log sources into Microsoft Sentinel.
• Develop parsers, data transformations and normalisation for telemetry.
• Design and optimise KQL queries for monitoring and detection.
• Create and tune analytics rules, alerts and detection logic.
• Develop Logic Apps, Playbooks and SOAR automation workflows.
• Support SIEM migration from LogRhythm to Microsoft Sentinel.
• Maintain CI/CD pipelines for SIEM content using Azure DevOps and Git.
• Automate deployment and configuration of Sentinel content.
• Collaborate with Cyber Defence and Security Operations teams.
• Contribute to threat hunting and detection engineering.

Job description

At Sword, we help power, secure and transform the organisations that keep the UK running. Supporting customers across Critical National Infrastructure, energy, public sector and enterprise markets, we combine deep industry expertise with leading technology services spanning managed services, cyber security, cloud, data, AI and digital transformation.

Join Sword and you'll be part of a team solving complex challenges, delivering real-world impact and working alongside talented colleagues who care deeply about quality, collaboration and customer success.

About the Role:

As an OT SIEM Engineer, you will play a key role in strengthening cyber security monitoring and threat detection capabilities across complex enterprise and Operational Technology (OT) environments, with a particular focus on Microsoft Sentinel.

This is a hands‑on engineering role where you will support the development and enhancement of SIEM capabilities, integrating security telemetry, developing detection content and implementing automation to improve security operations. You'll work closely with Cyber Defence and Security Operations teams, helping to deliver effective monitoring and threat detection solutions within Critical National Infrastructure.

You’ll also support the migration and integration of log data from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel, contributing to the ongoing development of a modern, scalable security monitoring capability.

You’ll be joining at an exciting time as we continue to grow our cyber security capabilities and deliver increasingly complex solutions for our customers. Sword was recently named Splunk 2026 EMEA Services Partner of the Year for Outstanding Regional Partnership in the AI-Driven Era, recognising the strength of our technical expertise, customer partnerships and the work being delivered across our practice. It’s a great opportunity to become part of that continued growth while helping protect the systems and infrastructure that deliver essential services.

As an OT SIEM Engineer, you will:

• Onboard and integrate log sources into Microsoft Sentinel across enterprise and Operational Technology environments.
• Develop and maintain custom parsers, data transformations and normalisation processes to improve the quality and consistency of security telemetry.
• Design, develop and optimise Kusto Query Language (KQL) queries to support security monitoring and threat detection.
• Create, tune and maintain analytics rules, alerts and detection logic to strengthen security monitoring capabilities.
• Develop and support Logic Apps, Playbooks and SOAR automation workflows to improve the efficiency of security operations.
• Support the migration and integration of security telemetry from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel.
• Implement and maintain CI/CD pipelines using Azure DevOps and Git to support the deployment and management of SIEM content.
• Automate the deployment, configuration and ongoing management of Sentinel content and integrations.
• Work closely with Cyber Defence and Security Operations teams to enhance monitoring, threat detection and incident response capabilities.
• Contribute to threat hunting, detection engineering and continuous improvement activities.
• Apply security engineering best practice within complex, highly regulated environments.

• Proven hands‑on experience in SIEM engineering, administration or security monitoring environments.
• Experience onboarding log sources and integrating security telemetry into enterprise SIEM platforms.
• Strong understanding of log parsing, data normalisation and event correlation.
• Experience developing and optimising queries using KQL or equivalent SIEM query languages.
• Knowledge of threat detection, security use case development and alert tuning.
• Understanding of security monitoring, incident response and threat hunting activities.
• Experience working with automation technologies such as Logic Apps, Playbooks or equivalent SOAR platforms.
• Familiarity with source control and CI/CD tools such as Git and Azure DevOps.
• Strong analytical and problem‑solving skills, with the ability to troubleshoot complex technical issues.
• Ability to work independently while collaborating effectively with technical teams and customer stakeholders.
• Strong communication skills and the ability to translate technical requirements into practical engineering solutions.

It would be great if you also had:

• Hands‑on experience engineering and administering Microsoft Sentinel.
• Experience with LogRhythm or other enterprise SIEM technologies such as Splunk, QRadar, ArcSight or Elastic.
• Experience implementing security automation and orchestration capabilities.
• Knowledge of Microsoft Azure security services and cloud-native security monitoring.
• Experience working within Operational Technology (OT), Critical National Infrastructure, utilities or energy environments.
• Understanding of security frameworks including NIST, MITRE ATT&CK and Cyber Essentials.
• Experience supporting SIEM migration or transformation programmes.
• Current Security Check (SC) clearance or eligibility to obtain clearance.

At Sword, our core values and culture are based on caring about our people, investing in training and career development, and building inclusive teams where we are all encouraged to contribute to achieve success. We offer comprehensive benefits designed to support your professional development and enhance your overall quality of life. Here’s what you can expect as part of our benefits package:

• Personalised Career Development: We create a development plan customised to your goals and aspirations, with a range of learning and development opportunities within a culture that encourages growth.
• Flexible working: Flexible work arrangements to support your work‑life balance. We can’t promise to always be able to meet every request, however, are keen to discuss your individual preferences to make it work where we can.
• A Fantastic Benefits Package: This includes generous annual leave allowance, enhanced family friendly benefits, pension scheme, access to private health, well‑being, and insurance schemes.

At Sword we are dedicated to fostering a diverse and inclusive workplace and are proud to be an equal opportunities employer, ensuring that all applicants receive fair and equal consideration for employment, regardless of whether they meet every requirement. We embrace diversity in all its forms, valuing individuals regardless of age, disability, gender identity or reassignment, marital or civil partner status, pregnancy or maternity status, race, colour, nationality, ethnic or national origin, religion or belief, sex, or sexual orientation. Your perspective and potential are important to us.

If we can do anything to help make the hiring process more accessible, please let our talent acquisition team know when you apply so we can support any adjustments.