SIEM Content and Platform Engineer CyberOne · London · Platform & Infrastructure £62,500–£79,875 e 2w ago

Devopsroles; Greater London; Hybride; GBP 70 000 - 110 000; Plein temps

Résumé du poste

CyberOne in London is seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. You will design, develop and onboard detection content for Microsoft Sentinel, integrate with Defender XDR and scale telemetry across our enterprise.

You will work with Security Operations, Cloud and Infrastructure teams, build dashboards, run POCs, and support critical incidents. The role requires hands-on engineering, strong knowledge of MITRE ATT&CK, and a proactive delivery mindset.

Qualifications

• Proven SIEM or security platform engineering experience in large enterprises.
• Hands-on with Microsoft Sentinel and Defender XDR (Endpoint/Identity/Cloud).
• Experience developing high-fidelity detections, threat-hunting queries, cross-data correlation, and enrichment.
• Experience onboarding infrastructure, cloud, application, and security telemetry into a SIEM.
• Security architecture, platform hardening, vulnerability remediation, and risk assessment experience.
• Automation and scripting with PowerShell and Python; CI/CD and IaC knowledge.

Responsabilités

• Act as SME for Microsoft Sentinel and security platforms.
• Design, test, deploy and tune analytics rules, correlation logic, threat-hunting queries, and reusable content.
• Engineer data connectors, ingestion pipelines, Data Collection Rules, parsers, and integrations.
• Develop logging standards, onboarding patterns, and governance for detection lifecycle.
• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python.
• Perform security engineering activities including risk assessment and platform hardening.
• Support integration of security controls with SIEM/ Defender ecosystem.
• Build dashboards, health monitoring, and KPI/KRI reporting for the Proactive Security function.
• Produce High-Level and Low-Level Designs and operating procedures.
• Lead platform enhancements, migrations, upgrades, and incident support.

Connaissances

Microsoft Sentinel

Defender XDR

Threat detection

KQL

Security architecture

CI/CD

Automation

Formation

Degree or equivalent in IT / Cyber Security

SC-200

AZ-500

Outils

PowerShell

Python

Azure Functions

Logic Apps

REST APIs

Git-based CI/CD

Description du poste

“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio—across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title: SIEM Content and Platform Engineer

Location: Hybrid; 1 day per month reporting in London office

Employment Type: Full Time

Purpose of Role

We are seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. The role combines SIEM platform engineering, detection content development, security engineering, automation, and operational support to improve enterprise monitoring and cyber resilience.

The engineer will work with Security Operations, Infrastructure, Cloud, and Application teams to deliver scalable telemetry, high-fidelity detections, secure integrations, and continuous improvement of the Proactive Security monitoring capability.

Main Duties and Responsibilities

• Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms.

• Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK.

• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations.

• Develop logging standards, onboarding patterns, use-case documentation, and governance for the detection engineering lifecycle.

• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python.

• Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation, and security control validation.

• Support integration and engineering of endpoint, identity, cloud, network, and infrastructure security controls with the SIEM and Defender ecosystem.

• Build Sentinel Workbooks, dashboards, platform health monitoring, and KPI/KRI reporting for the Proactive Security function.

• Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures, and support documentation.

• Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting, and technical support during critical incidents and major changes.

Specification

Essential Experience

• Proven experience in SIEM, detection, or security platform engineering within a large enterprise environment.

• Strong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity, and Cloud.

• Experience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation, and contextual enrichment.

• Experience onboarding infrastructure, cloud, application, and security telemetry into a SIEM.

• Practical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment, and security control validation.

• Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting, and operational support.

• Experience applying Detection-as-Code, CI/CD, source control, and peer-review practices.

Technical Knowledge and Skills

• Advanced Microsoft Sentinel administration, architecture, KQL, analytics rules, hunting, workbooks, watchlists, playbooks, and optimisation.

• Azure Monitor Agent, Azure Arc, Data Collection Rules, Log Analytics, custom tables, parsers, and custom ingestion.

• Windows Event Forwarding and Collection, XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging.

• Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation.

• MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management.

• Security engineering across endpoint, identity, cloud, network, and hybrid infrastructure controls.

• Azure DevOps or equivalent Git-based CI/CD, Infrastructure-as-Code concepts, secure development practices, and tools such as Cribl.

Qualifications

• Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering, or a related discipline.

• Relevant Microsoft certifications such as SC-200 or AZ-500 are desirable.

• Additional cloud, SIEM, security engineering, or automation certifications are advantageous.

Key Behaviours and Competencies

• Proactive, accountable, and delivery-focused approach.

• Strong analytical, troubleshooting, and problem-solving capability.

• Clear communication with technical, operational, and management stakeholders.

• Effective collaboration across teams, regions, and technical disciplines.

• Calm, structured delivery under pressure, with disciplined documentation and prioritisation.

• Willingness to provide planned out-of-hours support for critical upgrades and major changes when required.

Why Join Us?

• Work with cutting-edge Azure technologies and drive cloud transformation projects.

• Be part of a dynamic team that values innovation, collaboration, and technical excellence.

• Competitive compensation, career growth opportunities, and access to continuous learning and certifications.

• Opportunity to work on impactful cloud initiatives across various industries.

Why CyberOne:

• Elite positioning: Microsoft Security Partner, CREST & NCSC-certified

• Access to cutting-edge MXDR platform & proprietary SecOps tools

• No glass ceilings: rapid growth, fast-track leadership opportunities

• Culture-first: bold values, open feedback, and relentless innovation

Let’s redefine what it means to be secure. Together.

#CyberDefenders