SC-Cleared SIEM Engineer: Sentinel & SOAR Automation

Harvey Nash; Reading; On-site; GBP 65,000 - 90,000; Full time

Job summary

Harvey Nash in the United Kingdom seeks an experienced SEIM Engineer with Active SC clearance to onboard and integrate security log sources into Microsoft Sentinel, delivering reliable telemetry and comprehensive threat visibility.

You will develop custom parsers, transformations and KQL queries, and design SIEM detections aligned to evolving threats. CI/CD pipelines with Azure DevOps/Git enable controlled deployments.

Qualifications

• Active SC Clearance used in last 12 months.
• 6 months experience onboarding security logs.

Responsibilities

• Integrate and onboard log sources into Microsoft Sentinel, ensuring reliable security telemetry.
• Develop custom parsers, data transformations and KQL queries for threat detection and investigation.
• Create and maintain analytic rules and detection logic aligned to emerging threats and business requirements.
• Develop Logic Apps and SOAR workflows to automate security response.
• Implement CI/CD pipelines using Azure DevOps/Git for controlled SIEM content deployment.
• Automate SIEM configuration and deployments across environments.
• Continuously tune and optimise detections to improve accuracy and reduce false positives.
• Experience with LogRhythm, Check Point firewalls and SIEM logging platforms.
• SEC503 / SANS certification or training would be highly desirable.

Skills

Microsoft Sentinel integration

KQL queries

Logic Apps / SOAR

CI/CD pipelines

Azure DevOps

Git

SIEM tuning

Threat detection

LogRhythm

Check Point firewalls

Tools

Azure DevOps

Git

Logic Apps

Microsoft Sentinel

LogRhythm

Check Point

Job description

Harvey Nash in the United Kingdom seeks an experienced SEIM Engineer with Active SC clearance to onboard and integrate security log sources into Microsoft Sentinel, delivering reliable telemetry and comprehensive threat visibility.

You will develop custom parsers, transformations and KQL queries, and design SIEM detections aligned to evolving threats. CI/CD pipelines with Azure DevOps/Git enable controlled deployments.