OT SIEM Engineer: Sentinel & Threat Detection

Sword Group; Aberdeen City; On-site; GBP 60,000 - 85,000; Full time

Benefits offered by this job

Flexible working

Career development

Private health

Pension scheme

Job summary

Sword is seeking an OT SIEM Engineer to strengthen security monitoring across enterprise and OT environments, with emphasis on Microsoft Sentinel. The role involves hands-on development, log onboarding, parser creation and threat detection improvements to support Cyber Defence and Security Operations teams.

You will migrate log data from LogRhythm to Sentinel, build automation, and contribute to scalable security monitoring.

Qualifications

• Hands-on experience in SIEM engineering, administration or security monitoring.
• Experience onboarding log sources into enterprise SIEM platforms.
• Strong knowledge of log parsing, data normalisation and event correlation.
• Experience developing and optimising KQL queries.
• Knowledge of threat detection, security use case development and alert tuning.
• Understanding of security monitoring, incident response and threat hunting activities.
• Experience with automation technologies such as Logic Apps, Playbooks or SOAR.
• Familiarity with Git and Azure DevOps for CI/CD.
• Strong analytical and problem-solving skills.
• Ability to work independently while collaborating with technical teams and stakeholders.
• Strong communication skills and the ability to translate requirements into engineering solutions.

Responsibilities

• Onboard and integrate log sources into Microsoft Sentinel across OT and enterprise environments.
• Develop and maintain parsers, data transformations and normalisation processes for telemetry.
• Design and optimise KQL queries to support monitoring and detection.
• Create, tune and maintain analytics rules, alerts and detection logic.
• Develop and support Logic Apps, Playbooks and SOAR automation workflows.
• Migrate security telemetry from existing SIEM platforms into Microsoft Sentinel.
• Implement and maintain CI/CD pipelines using Azure DevOps and Git.
• Automate deployment, configuration and ongoing management of Sentinel content.
• Collaborate with Cyber Defence and Security Operations teams to enhance capabilities.
• Contribute to threat hunting, detection engineering and continuous improvement.
• Apply security engineering best practices in regulated environments.

Skills

SIEM engineering

Security monitoring

Incident response

Threat hunting

Problem solving

Communication skills

Tools

Microsoft Sentinel

LogRhythm

Git

Azure DevOps

Kusto Query Language (KQL)

Logic Apps

Job description

Sword is seeking an OT SIEM Engineer to strengthen security monitoring across enterprise and OT environments, with emphasis on Microsoft Sentinel. The role involves hands-on development, log onboarding, parser creation and threat detection improvements to support Cyber Defence and Security Operations teams.

You will migrate log data from LogRhythm to Sentinel, build automation, and contribute to scalable security monitoring.