Sentinel Detection Lead: Tenant Rationalisation (Remote)

Matchtech Group; City Of London; Híbrido; GBP 90.000 - 130.000; Jornada completa

Descripción de la vacante

Matchtech Group is seeking a Tenant Rationalisation, SOC Assessment & Detection Lead to drive Microsoft security recommendations across a complex enterprise. This is a hands-on technical leadership role focused on Microsoft Sentinel, detection engineering, and SOC transformation in a predominantly remote environment with periodic site attendance.

You will translate assessment outcomes into remediation plans, lead delivery activity, develop detections and KQL queries, and coordinate across

Formación

• Strong commercial experience with Microsoft Sentinel.
• Advanced KQL development and detection engineering expertise.
• Experience designing, building and tuning analytics rules and use cases.
• SOC delivery experience.
• Azure security and remediation experience.
• Experience working within complex or multi-tenant environments.
• Proven ability to lead technical delivery whilst remaining hands-on.

Responsabilidades

• Lead delivery of tenant rationalisation and security remediation activities.
• Design, build and optimise Microsoft Sentinel detections and analytics rules.
• Develop and tune KQL queries to improve threat detection coverage.
• Translate SOC assessment findings into a prioritised delivery backlog.
• Coordinate implementation activities across technical teams.
• Validate security improvements and ensure agreed acceptance criteria are met.
• Support testing, stakeholder engagement and delivery governance.

Conocimientos

MS Sentinel

KQL development

Detection engineering

SOC delivery

Azure security

Multi-tenant environments

Technical leadership

Descripción del empleo

Matchtech Group is seeking a Tenant Rationalisation, SOC Assessment & Detection Lead to drive Microsoft security recommendations across a complex enterprise. This is a hands-on technical leadership role focused on Microsoft Sentinel, detection engineering, and SOC transformation in a predominantly remote environment with periodic site attendance.

You will translate assessment outcomes into remediation plans, lead delivery activity, develop detections and KQL queries, and coordinate across