OT SIEM Engineer - Microsoft Sentinel & Threat Detection

Sword Group; Glasgow; Hybrid; GBP 65.000 - 90.000; Vollzeit

Benefits dieser Stelle

Personalised Career Development

Flexible working

Excellent benefits package

Zusammenfassung

Sword Group is seeking an OT SIEM Engineer to strengthen cyber security monitoring across complex OT environments, with a focus on Microsoft Sentinel. The role involves implementing automation, integrating telemetry and developing detection content to improve security operations.

You will collaborate with Cyber Defence and Security Operations teams, migrate data from LogRhythm, and contribute to threat hunting within Critical National Infrastructure contexts.

Qualifikationen

• Hands-on SIEM engineering experience.
• Onboarding log sources and integrating security telemetry.
• Strong understanding of log parsing, normalization and event correlation.
• Experience with KQL or similar SIEM query languages.
• Security monitoring, incident response and threat hunting knowledge.
• Familiarity with automation such as Logic Apps or SOAR.
• Proficiency with Git and CI/CD tooling.
• Analytical and problem-solving skills.
• Ability to work independently and with teams.
• Excellent communication with stakeholders.

Aufgaben

• As onboard and integrate log sources into Microsoft Sentinel.
• Develop parsers, data transformations and normalisation for telemetry.
• Design and optimise KQL queries for monitoring and detection.
• Create and tune analytics rules, alerts and detection logic.
• Develop Logic Apps, Playbooks and SOAR automation workflows.
• Support SIEM migration from LogRhythm to Microsoft Sentinel.
• Maintain CI/CD pipelines for SIEM content using Azure DevOps and Git.
• Automate deployment and configuration of Sentinel content.
• Collaborate with Cyber Defence and Security Operations teams.
• Contribute to threat hunting and detection engineering.

Jobbeschreibung

Sword Group is seeking an OT SIEM Engineer to strengthen cyber security monitoring across complex OT environments, with a focus on Microsoft Sentinel. The role involves implementing automation, integrating telemetry and developing detection content to improve security operations.

You will collaborate with Cyber Defence and Security Operations teams, migrate data from LogRhythm, and contribute to threat hunting within Critical National Infrastructure contexts.