Senior Microsoft Sentinel Engineer - SIEM & Automation

Experis (Austria); Greater London; Hybrid; GBP 92,000 - 138,000; Full time

Job summary

Experis is partnering with a leading Microsoft Security Partner to deliver a major cyber security transformation for a large financial services organisation in London. We seek an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to own the platform, detections, and automation.

This hands-on role focuses on engineering, configuring, and optimising Sentinel, developing advanced KQL detections, integrating telemetry, and driving CI/CD for detections within a

Qualifications

• Hands-on experience implementing and optimising Microsoft Sentinel beyond SOC monitoring.
• Strong ability to develop complex KQL queries, analytics rules and detections.
• Experience designing and maintaining SIEM content and use cases.
• Practical exposure to Azure Monitor Agent, DCRs and Log Analytics.
• Experience integrating Defender XDR and other security technologies.
• Automation skills with Logic Apps, PowerShell or Python.
• Experience with MITRE ATT&CK coverage.
• Proficient in CI/CD for detections and telemetry.
• Familiarity with Git/GitHub and Azure DevOps.
• Experience in financial services or regulated environments.

Responsibilities

• Engineer, configure and optimise Microsoft Sentinel across a complex enterprise.
• Develop, test and maintain advanced KQL queries, rules and detections.
• Design and manage telemetry ingestion using AMA, DCRs and Log Analytics.
• Integrate Sentinel with Defender XDR, Entra ID and other sources.
• Develop automated security workflows using Logic Apps, Functions, PowerShell and API calls.
• Improve detection quality and reduce false positives using MITRE ATT&CK.
• Troubleshoot ingestion pipelines and SIEM integration issues.
• Optimize ingestion costs, retention and log filtering.
• Support continuous improvement of enterprise detection engineering.

Skills

Sentinel Engineering

Advanced KQL

Detection Engineering

Data Ingestion

Security Integrations

Automation

MITRE ATT&CK

CI/CD pipelines

Git/GitHub

Azure DevOps

Tools

Azure Monitor Agent

Data Collection Rules

Log Analytics

Custom connectors

Job description

Experis is partnering with a leading Microsoft Security Partner to deliver a major cyber security transformation for a large financial services organisation in London. We seek an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to own the platform, detections, and automation.

This hands-on role focuses on engineering, configuring, and optimising Sentinel, developing advanced KQL detections, integrating telemetry, and driving CI/CD for detections within a