Senior SIEM & Sentinel Platform Engineer

Devopsroles; Greater London; Hybride; GBP 70 000 - 110 000; Plein temps

Résumé du poste

CyberOne in London is seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. You will design, develop and onboard detection content for Microsoft Sentinel, integrate with Defender XDR and scale telemetry across our enterprise.

You will work with Security Operations, Cloud and Infrastructure teams, build dashboards, run POCs, and support critical incidents. The role requires hands-on engineering, strong knowledge of MITRE ATT&CK, and a proactive delivery mindset.

Qualifications

• Proven SIEM or security platform engineering experience in large enterprises.
• Hands-on with Microsoft Sentinel and Defender XDR (Endpoint/Identity/Cloud).
• Experience developing high-fidelity detections, threat-hunting queries, cross-data correlation, and enrichment.
• Experience onboarding infrastructure, cloud, application, and security telemetry into a SIEM.
• Security architecture, platform hardening, vulnerability remediation, and risk assessment experience.
• Automation and scripting with PowerShell and Python; CI/CD and IaC knowledge.

Responsabilités

• Act as SME for Microsoft Sentinel and security platforms.
• Design, test, deploy and tune analytics rules, correlation logic, threat-hunting queries, and reusable content.
• Engineer data connectors, ingestion pipelines, Data Collection Rules, parsers, and integrations.
• Develop logging standards, onboarding patterns, and governance for detection lifecycle.
• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python.
• Perform security engineering activities including risk assessment and platform hardening.
• Support integration of security controls with SIEM/ Defender ecosystem.
• Build dashboards, health monitoring, and KPI/KRI reporting for the Proactive Security function.
• Produce High-Level and Low-Level Designs and operating procedures.
• Lead platform enhancements, migrations, upgrades, and incident support.

Connaissances

Microsoft Sentinel

Defender XDR

Threat detection

KQL

Security architecture

CI/CD

Automation

Formation

Degree or equivalent in IT / Cyber Security

SC-200

AZ-500

Outils

PowerShell

Python

Azure Functions

Logic Apps

REST APIs

Git-based CI/CD

Description du poste

CyberOne in London is seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. You will design, develop and onboard detection content for Microsoft Sentinel, integrate with Defender XDR and scale telemetry across our enterprise.

You will work with Security Operations, Cloud and Infrastructure teams, build dashboards, run POCs, and support critical incidents. The role requires hands-on engineering, strong knowledge of MITRE ATT&CK, and a proactive delivery mindset.