Security Automation & Detection Engineer - MS Sentinel

Whitehall Resources Ltd; Cambridge; On-site; GBP 60,000 - 80,000; Full time

Job summary

A leading company is seeking a Security Automation & Detection Engineer specializing in MS Sentinel. This role involves enhancing security operations through automation and detection engineering. With responsibilities including building SIEM detections and collaborating with various teams on security tasks, candidates should possess extensive cybersecurity experience and a solid understanding of cloud security tools.

Qualifications

• 3+ years in security operations or security software development.
• Extensive experience in MS Sentinel, including log onboarding and automation.
• Understanding of security operations and SIEM management.

Responsibilities

• Build automation and SIEM detections for security capabilities.
• Collaborate with analysts to automate repetitive tasks.
• Lead migration of log sources into Microsoft Sentinel.

Skills

Automation and orchestration tools

Incident response

Detection engineering

Cloud security tools

Tools

MS Sentinel

Python

PowerShell

Job description

Security Automation & Detection Engineer - MS Sentinel

Whitehall Resources require a Security Automation & Detection Engineer focusing on MS Sentinel to work with a key client on an initial 6 month contract.

*This role will involve on site work in Cambridge 2 days per week.

*Inside IR35.

Security Automation & Detection Engineer - MS Sentinel

Role Overview:
Utilising knowledge of security operations, incident response, and detection engineering, you will be responsible for the delivery of SIEM detections and security automations.
The successful candidate will be proficient in automation and orchestration tools (eg, SOAR platforms, Scripting languages like Python, PowerShell) and have experience with integrating security tools (eg, SIEM, EDR, Firewalls) APIs, and Case Management tools for data enrichment.

Responsibilities:
* Build security automations, logging, and SIEM detections to improve the CDO's efficiency, scalability, and incident response capabilities.
* Design, implement, and maintain automated workflows and playbooks to streamline CDO operations, including incident response, threat hunting, cyber threat intelligence and vulnerability management.
* Collaborate with CDO analysts to identify repetitive tasks and automate them to improve operational efficiency.
* Collaborate with Threat Intelligence, Incident Response, and Attack Surface Management to build and tune robust SIEM detections for both proactive and reactive response actions.
* Continuously evaluate automation solutions for performance, reliability, and scalability, making improvements, as necessary.
* Collaborate with third-party vendors and service providers to leverage automation opportunities and ensure successful integrations.
* Lead technical migration of log sources into Microsoft Sentinel SIEM.

Required Skills and Experience:
* Extensive experience with MS Sentinel - including Log onboarding, detection engineering and automation.
* Demonstrated ability in cybersecurity, with at least 3 years in a technical role in security operations and/or security software development.
* Solid understanding of security operations, automations standard processes, detection engineering and SIEM management.
* Experience with cloud security tools and platforms (eg Azure, AWS Google Cloud) and their integration into SOC operations.
* Vendor-specific certifications for SOAR platforms (eg, Sentinel SOAR, Splunk SOAR, Palo Alto Cortex XSOAR).
* Experience contributing to large-scale, sprint-based, security automation and detection engineering projects.

"Nice To Have" Skills and Experience:
* Ability to develop and implement long-term automation strategies aligned with security operation objectives.
* Ability to translate technical concepts into clear, actionable insights for technical and non-technical partners.
* Meticulous focus on ensuring accuracy, reliability, and security in automation workflows!
* Consistent record of implementing automation and integration solutions in a SOC or similar environment!

All of our opportunities require that applicants are eligible to work in the specified country/location, unless otherwise stated in the job description.

Whitehall Resources are an equal opportunities employer who value a diverse and inclusive working environment. All qualified applicants will receive consideration for employment without regard to race, religion, gender identity or expression, sexual orientation, national origin, pregnancy, disability, age, veteran status, or other characteristics.