SIEM Automation Engineer

ZipRecruiter; Leeds; Remote; GBP 60,000 - 69,000; Full time

Job summary

A leading Microsoft MSSP seeks a SIEM Automation Engineer to enhance security operations. The role involves designing workflows in Microsoft Sentinel and optimizing threat detection processes with Defender for Endpoint. Candidates should have proven experience in automation and cybersecurity. This remote position pays up to £60k plus on-call, totaling a £65k package.

Qualifications

• Proven experience working with Microsoft Sentinel and Defender for Endpoint.
• Strong proficiency in KQL for deep threat hunting.
• Knowledge of SIEM automation, playbooks, and integrations.
• Experience in cybersecurity operations and incident response.
• Passion for proactive cyber defense strategies.

Responsibilities

• Design and implement automation workflows within Microsoft Sentinel.
• Monitor and respond to security incidents and alerts.
• Conduct in-depth threat hunting and forensic investigations using KQL.
• Optimize security processes with Defender for Endpoint.
• Collaborate with teams to develop automated responses to cyber threats.

Skills

Microsoft Sentinel

Defender for Endpoint

KQL

Cybersecurity Operations

Incident Response

Automation

Job description

Job Description

SIEM Automation Engineer - Leading Microsoft MSSP

An opportunity to work with one of the top 1% Microsoft MSSPs globally, where cutting-edge security solutions meet expert cyber defense. With a 16-person SOC team, this role offers the chance to automate, optimize, and strengthen security operations at scale.

A key position within a world-class MSSP, leveraging Microsoft Sentinel, Defender for Endpoint, and KQL to enhance threat detection, response, and security automation. Responsibilities include developing automated security workflows, streamlining investigations, and advancing proactive defense strategies.

Key Responsibilities:

• Design and implement automation workflows within Microsoft Sentinel for enhanced security operations.

• Monitor and respond to security incidents and alerts, ensuring the protection of our clients' data and infrastructure.

• Conduct in-depth threat hunting and forensic investigations using KQL.




• Optimize security processes with Defender for Endpoint to detect, contain, and remediate threats.




• Collaborate with security analysts, engineers, and SOC teams to develop automated responses to cyber threats.




• Continuously improve security monitoring strategies and contribute to the overall SIEM architecture.

Experience required:

• Proven experience working with Microsoft Sentinel and Defender for Endpoint.




• Strong proficiency in KQL for deep threat hunting and security analytics.




• Knowledge of SIEM automation, playbooks, and integrations.




• Experience in cybersecurity operations, threat detection, and incident response.




• Passion for security automation and proactive cyber defense strategies.

Paying up to 60k + on-call (65k total package)

Remote based.

Must be eligible for SC