SC Cleared Security Consultant

Xcede; Newcastle upon Tyne; On-site; GBP 111,000 - 166,000; Full time

Job summary

Xcede is seeking a hands-on Microsoft Sentinel engineer to lead the ingestion of security data into Sentinel across a large cloud security modernisation programme. You will connect data sources, configure AMA and DCRs, and fix ingestion issues across various Azure environments.

This is an engineering role focused on building reliable, well-documented data pipelines and enabling ongoing support. As part of the engagement, you’ll deliver working connectors, validate data flows with evidence,

Qualifications

• Hands-on Microsoft Sentinel engineering experience.
• Configuring and troubleshooting Sentinel data connectors.
• In-depth knowledge of Azure Monitor Agent and Data Collection Rules.
• Good working knowledge of KQL.
• Experience with security log pipelines, ingestion, parsing and normalisation.
• Experience testing and validating security telemetry.
• Strong integration and troubleshooting skills.

Responsibilities

• Configuring and troubleshooting Microsoft Sentinel data connectors.
• Setting up Azure Monitor Agent (AMA) and Data Collection Rules (DCRs).
• Building and fixing security log-routing and ingestion pipelines.
• Writing and adapting KQL queries to validate ingestion and diagnose problems.
• Making parsing and normalisation changes where needed.
• Testing data completeness, quality and ingestion latency.
• Finding and fixing failed, incomplete or unreliable data feeds.
• Monitoring connector health and improving reliability.
• Onboarding and stabilising security data across multiple Azure environments.
• Writing configuration, testing and operational support documentation.

Skills

Microsoft Sentinel

Sentinel data connectors

Azure Monitor Agent

Data Collection Rules

KQL

Security telemetry

Ingestion pipelines

MSSP / multi-tenant Sentinel

Tools

Azure Monitor

Syslog/CEF ingestion

Windows Security Events

Job description

We're looking for a hands-on Microsoft Sentinel engineer to get security data flowing reliably into Sentinel on a large Microsoft cloud security modernisation programme. You'll connect data sources, configure Azure Monitor Agent and Data Collection Rules, and fix ingestion problems across several Azure environments. The aim is security telemetry that is complete, trustworthy and easy to support once you hand it over. This is an engineering role, not a SOC analyst or Microsoft 365 admin role. We need someone who has built and troubleshot Sentinel ingestion themselves, ideally in multi-tenant or MSSP-style environments.

What you'll be doing

• Configuring and troubleshooting Microsoft Sentinel data connectors
• Setting up Azure Monitor Agent (AMA) and Data Collection Rules (DCRs)
• Building and fixing security log-routing and ingestion pipelines
• Writing and adapting KQL queries to validate ingestion and diagnose problems
• Making parsing and normalisation changes where needed
• Testing data completeness, quality and ingestion latency
• Finding and fixing failed, incomplete or unreliable data feeds
• Monitoring connector health and improving reliability
• Onboarding and stabilising security data across multiple Azure environments
• Writing configuration, testing and operational support documentation

By the end of the engagement you'll have delivered working connectors, validated data flows with test evidence, a connector health baseline, and documentation the support team can run with.

What you'll bring

• Strong hands-on Microsoft Sentinel engineering experience
• Practical experience configuring and troubleshooting Sentinel data connectors
• In-depth knowledge of Azure Monitor Agent and Data Collection Rules
• Good working knowledge of KQL
• Experience with security log pipelines, ingestion, parsing and normalisation
• Experience testing and validating security telemetry
• Strong integration and troubleshooting skills
• A solid understanding of Azure security and SOC/SIEM environments

Nice to have

• Microsoft Defender products (Defender XDR, Defender for Endpoint, Defender for Cloud)
• Azure Monitor and Log Analytics
• Microsoft Entra ID and Microsoft 365 security data
• Syslog/CEF ingestion
• Windows Security Events
• Custom log and API-based ingestion
• SIEM migration or consolidation projects
• Multi-tenant or MSSP-style Sentinel environments

ASAP - End of March