Security engineer

Tria; Cardiff; Hybrid; GBP 45,000 - 55,000; Full time

Benefits offered by this job

Remote work flexibility

Job summary

Tria is seeking a Security Engineer to work on Microsoft Sentinel and Defender XDR in Cardiff with remote flexibility (3/4 days onsite per month). This permanent role focuses on engineering, incident response escalations, and strengthening client environments.

You will build detection rules, configure Defender XDR and Office 365 security controls, and develop automation using Azure Logic Apps. Strong communication and independent ownership are essential for progression.

Qualifications

• Strong hands-on experience with Defender XDR and Sentinel.
• Proficient in KQL and Advanced Hunting.
• Experience building or improving security solutions.
• Familiar with DevOps and CI/CD.
• Able to communicate with clients and explain findings.
• Able to work independently and own tasks.
• Eligible for transferable security clearance; sponsor available.

Responsibilities

• Build, deploy and tune Sentinel detection rules using KQL.
• Configure and optimise Defender XDR and wider Microsoft 365 security controls.
• Develop automation and response playbooks using Azure Logic Apps.
• Run vulnerability scans and phishing simulations, translating findings into practical recommendations.
• Contribute to development and deployment processes using DevOps and CI/CD.
• Share knowledge with colleagues and participate in an on-call rota.

Skills

Defender XDR

Sentinel

KQL

Advanced Hunting

Security Solutions

DevOps

CI/CD

Client communication

Ownership

Tools

Azure Logic Apps

Job description

Security Engineer - Microsoft Sentinel & Defender

Cardiff / Remote (3/4 days per month onsite)

Permanent

50,000

I'm working with a Microsoft security partner to recruit a Security Engineer into its Security Operations team. This is a great opportunity for an Analyst to step into and Engineering position, or a Junior Engineer looking for a more supportive and collaborative environment.

You'll help develop and improve security capabilities across Microsoft Sentinel and Defender XDR, working directly with clients to strengthen their environments. This is a hands-on engineering position, with incident response involvement focused on escalations rather than routine alert monitoring.

The role

• Build, deploy and tune Sentinel detection rules using KQL.
• Configure and optimise Microsoft Defender XDR and wider Microsoft 365 security controls.
• Develop automation and response playbooks using Azure Logic Apps.
• Run vulnerability scans and phishing simulations, translating findings into practical recommendations.
• Contribute to development and deployment processes using DevOps and CI/CD.
• Share knowledge with colleagues and participate in an on-call rota.

What we're looking for

• Strong hands‑on experience with Microsoft Defender XDR and Sentinel.
• Very good KQL and Advanced Hunting skills.
• Practical experience building, configuring or improving security solutions.
• Familiarity with DevOps and CI/CD pipelines.
• Confidence communicating with clients and explaining technical findings.
• The ability to take ownership of tasks and work independently.

You must hold transferable security clearance or be eligible to obtain it. The employer will sponsor the clearance process.

If this sounds like the type of position that would aid your career progression plans.