OT SIEM Engineer: Microsoft Sentinel & Automation

Sword Services Greece S.A.; Glasgow; On-site; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Career development

Flexible working

Generous benefits

Job summary

Sword is expanding its cyber security capabilities and seeks an OT SIEM Engineer to strengthen monitoring across OT and enterprise environments, focusing on Microsoft Sentinel. You will ingest logs, build parsers, and tune analytics while collaborating with Cyber Defence and Security Operations teams.

You will migrate data from LogRhythm, develop SIEM content, and implement CI/CD pipelines using Azure DevOps. Strong automation, detection engineering, and threat-hunting experience are essential.

Qualifications

• Hands-on experience in SIEM engineering, administration or security monitoring environments.
• Experience onboarding log sources and integrating security telemetry into enterprise SIEM platforms.
• Strong ability to design, implement and tune SIEM content and detection logic.

Responsibilities

• Onboard and integrate log sources into Microsoft Sentinel across enterprise and OT environments.
• Develop and maintain parsers, data transformations and normalization of security telemetry.
• Design and optimize KQL queries to support monitoring and threat detection.
• Create, tune and maintain analytics rules, alerts and detection logic.
• Develop and support Logic Apps, Playbooks and SOAR workflows for security operations.

Skills

SIEM engineering

Log ingestion

KQL development

Automation with Logic Apps

Git / CI/CD

Tools

Microsoft Sentinel

LogRhythm

Azure DevOps

Git

PowerShell

Job description

Sword is expanding its cyber security capabilities and seeks an OT SIEM Engineer to strengthen monitoring across OT and enterprise environments, focusing on Microsoft Sentinel. You will ingest logs, build parsers, and tune analytics while collaborating with Cyber Defence and Security Operations teams.

You will migrate data from LogRhythm, develop SIEM content, and implement CI/CD pipelines using Azure DevOps. Strong automation, detection engineering, and threat-hunting experience are essential.