Senior Security Engineer - SIEM, KQL

Harvey Nash Group; London; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A prominent recruitment agency is seeking a Security Engineer to enhance their investment bank's security operations based in London. The ideal candidate will have extensive experience with Microsoft Sentinel and KQL, focusing on SIEM management, log source integration, and threat detection. Responsibilities include developing detection rules and security monitoring. This position is inside IR35 with 3 days a week on-site work.

Qualifications

• 3+ years in Security Engineer, SOC Analyst, or similar role.
• Certifications such as AZ-500, SC-200, CompTIA Security+ are preferred.
• Hands-on experience with Microsoft Sentinel and KQL required.

Responsibilities

• Design, implement, and maintain Microsoft Sentinel workspaces.
• Develop advanced KQL queries for threat hunting.
• Monitor systems for anomalies and malicious activity.

Skills

Microsoft Sentinel

KQL

SIEM Management

Threat Detection

Scripting (PowerShell, Python)

Active Directory

Cloud platforms (Azure, AWS, GCP)

Tools

Microsoft Sentinel

EDR Tools

DLP Tools

Job description

Security Engineer - SIEM, KQL- sought by investment bank based in London.

*Inside IR35 - 3 days a week on-site**

Key Responsibilities

• SIEM Management & Optimization:
• Design, implement, and maintain Microsoft Sentinel workspaces, connectors, analytics rules, and playbooks
• Develop advanced KQL queries for threat hunting and reporting
• Optimize SIEM performance, cost, and data retention policies
• Troubleshoot log ingestion and parsing issues

• Log Source Integration:
• Onboard and configure critical log sources (AD, firewalls, servers, cloud infrastructure)
• Manage event collection and forwarding infrastructure
• Implement data filtering and custom log parsing
• Threat Detection & Use Case Development:
• Develop and refine detection rules based on threat intelligence and attack patterns
• Continuously improve detection efficacy and reduce false positives
• Security Monitoring & Incident Response:
• Monitor systems for anomalies and malicious activity
• Contribute to threat hunting and incident response playbooks
• Provide expert guidance on securing applications and infrastructure
• Security Advisory & Innovation:
• Support PoCs for new security tools
• Help define and measure control effectiveness
• Required Skills & Experience
  • Certifications: AZ-500, SC-200, SC-900, CompTIA Security+, CISSP, GCIA, GCIH, GCFA, CCSP
  • Experience with SOAR playbooks, YARA rules, STIX, and YAML
  • Participation in red/purple team exercises.
• • 3+ years in a Security Engineer, SOC Analyst, or similar role
  • Hands-on experience with Microsoft Sentinel and KQL
  • Strong knowledge of Active Directory, Windows/Linux systems, and cloud platforms (Azure, AWS, GCP)
  • Proficiency in scripting (PowerShell, Python)
  • Familiarity with security frameworks (MITRE ATT&CK, NIST, Kill Chain)
  • Experience with EDR, DLP, Proxy, and SEG tools
  Desirable Qualifications
• Certifications: AZ-500, SC-200, SC-900, CompTIA Security+, CISSP, GCIA, GCIH, GCFA, CCSP
• Experience with SOAR playbooks, YARA rules, STIX, and YAML
• Participation in red/purple team exercises.
• Please apply within for further details - Alex Reeder Harvey Nash