Security engineer in City

Tria; City; Hybrid; GBP 45,000 - 55,000; Full time

Job summary

Tria is seeking a Security Engineer to join its Security Operations team, focusing on Microsoft Sentinel and Defender XDR. The role is based in Cardiff with occasional remote/hybrid work.

This permanent position is hands-on, including incident response escalations, deployment and tuning of rules, and collaboration with clients to strengthen security postures. Strong KQL, Defender XDR and Sentinel experience are required, plus the ability to work independently and own tasks.

Qualifications

• Hands-on experience with Microsoft Defender XDR and Sentinel.
• Very good KQL and Advanced Hunting skills.
• Practical experience building, configuring or improving security solutions.
• Familiarity with DevOps and CI/CD pipelines.
• Confidence communicating with clients and explaining technical findings.
• Ability to take ownership of tasks and work independently.

Responsibilities

• Build, deploy and tune Sentinel detection rules using KQL.
• Configure and optimise Microsoft Defender XDR and wider Microsoft 365 security controls.
• Develop automation and response playbooks using Azure Logic Apps.
• Run vulnerability scans and phishing simulations, translating findings into practical recommendations.
• Contribute to development and deployment processes using DevOps and CI/CD.
• Share knowledge with colleagues and participate in an on-call rota.

Skills

Sentinel

Defender XDR

KQL

Advanced Hunting

DevOps

CI/CD

Client communication

Ownership

Independent work

Security clearance

Job description

Security Engineer - Microsoft Sentinel & Defender

Cardiff / Remote (3/4 days per month onsite)

Permanent

50,000

I'm working with a Microsoft security partner to recruit a Security Engineer into its Security Operations team. This is a great opportunity for an Analyst to step into and Engineering position, or a Junior Engineer looking for a more supportive and collaborative environment.

You'll help develop and improve security capabilities across Microsoft Sentinel and Defender XDR, working directly with clients to strengthen their environments. This is a hands-on engineering position, with incident response involvement focused on escalations rather than routine alert monitoring.

The role

• Build, deploy and tune Sentinel detection rules using KQL.
• Configure and optimise Microsoft Defender XDR and wider Microsoft 365 security controls.
• Develop automation and response playbooks using Azure Logic Apps.
• Run vulnerability scans and phishing simulations, translating findings into practical recommendations.
• Contribute to development and deployment processes using DevOps and CI/CD.
• Share knowledge with colleagues and participate in an on-call rota.

What we're looking for

• Strong hands‑on experience with Microsoft Defender XDR and Sentinel.
• Very good KQL and Advanced Hunting skills.
• Practical experience building, configuring or improving security solutions.
• Familiarity with DevOps and CI/CD pipelines.
• Confidence communicating with clients and explaining technical findings.
• The ability to take ownership of tasks and work independently.

You must hold transferable security clearance or be eligible to obtain it. The employer will sponsor the clearance process.

If this sounds like the type of position that would aid your career progression plans.