Senior Detection Engineer - Microsoft Sentinel (KQL)

Sopra Steria Ltd; Farnborough; Hybrid; GBP 55,000 - 60,000; Full time

Benefits offered by this job

Health Shields

Life assurance

Pension

25 days annual leave

Purchase 10 extra days

Job summary

Sopra Steria Ltd in the UK is seeking a Senior Detection Engineer to shape the future of Microsoft Sentinel detection engineering. You will design, develop and tune analytics using KQL, translating threat behaviours and operational requirements into reliable detections for a national security-focused SOC.

Hybrid: Farnborough three days per week, two days at home. SC Cleared or eligible. Salary up to £60,000 plus benefits and a strong focus on governance, testing, and continuous improvement.

Qualifications

• Strong hands-on experience with Microsoft Sentinel in a detection engineering role.
• Advanced KQL skills for building, troubleshooting and optimizing queries.
• Experience deploying and tuning scheduled analytics rules and Sentinel content.
• Mapping detections to MITRE ATT&CK and threat-informed use cases.

Responsibilities

• Design, develop and maintain Microsoft Sentinel analytics rules using KQL.
• Translate threat intel into measurable detection use cases.
• Map content to MITRE ATT&CK framework and identify gaps.
• Validate log sources, schemas and field mappings before developing logic.
• Tune analytics to reduce false positives while preserving performance.
• Manage detection content through peer review and controlled deployment.
• Collaborate with SOC analysts and threat intel teams to improve detections.
• Support threat hunting and investigations using Microsoft Sentinel.
• Contribute to detection engineering standards and governance.

Skills

Microsoft Sentinel

KQL

Analytics rules

MITRE ATT&CK

Git versioning

Data quality

Threat-informed use cases

Collaboration

Documentation

Tools

Azure DevOps

PowerShell

Python

Terraform

Job description

Sopra Steria Ltd in the UK is seeking a Senior Detection Engineer to shape the future of Microsoft Sentinel detection engineering. You will design, develop and tune analytics using KQL, translating threat behaviours and operational requirements into reliable detections for a national security-focused SOC.

Hybrid: Farnborough three days per week, two days at home. SC Cleared or eligible. Salary up to £60,000 plus benefits and a strong focus on governance, testing, and continuous improvement.