SIEM Content & Platform Engineer (Contract)

Curo Services; Greater London; Hybrid; GBP 92,000 - 111,000; Part time

Job summary

Curo Services is seeking an experienced SIEM Content & Platform Engineer to join their Cyber Security team in London. The role combines threat detection engineering with platform architecture across Sentinel and Defender ecosystems.

You will design and tune detection content, build data pipelines, and contribute to incident response and governance. The contract runs for ~5 months with a rate of £550, onsite 2 days/week, remote remainder, outside IR35.

Qualifications

• Experience in SIEM/detection engineering for enterprise environments.
• Strong design and implementation of detection content and rules.
• Hands-on with Microsoft Sentinel and Defender XDR.
• Experience with REST APIs, PowerShell and Python, plus CI/CD.

Responsibilities

• Act as SME for Microsoft Sentinel and security monitoring architecture.
• Design, test, deploy and tune analytics rules and queries aligned to MITRE ATT&CK.
• Engineer data connectors, ingestion pipelines and custom parsers.
• Develop logging standards, onboarding patterns and governance.
• Lead platform enhancements and support during critical incidents.

Skills

Detection engineering

Threat hunting

Automation

Security architecture

MITRE ATT&CK

Education

Bachelor's degree in IT or Cyber Security

SC-200 or AZ-500 desirable

Cloud, SIEM or automation certifications advantageous

Tools

Microsoft Sentinel

Defender XDR

KQL

Logic Apps

Azure Functions

REST APIs

PowerShell

Python

Data Collection Rules

Parsers

Workbooks

Playbooks

Cribl

Job description

We’re currently looking for an experienced SIEM Content & Platform Engineer to join a Cyber Security team.

Location: London (2 days per week onsite, remainder remote)
Duration: Initial 5 Month Contract
Rate: £550
IR35: Outside IR35
Start Date: ASAP

The Role:
You will act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture and associated security platforms.

Key Responsibilities:

• Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms


• Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK


• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations


• Develop logging standards, onboarding patterns, use-case documentation and governance for the detection engineering lifecycle


• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell and Python


• Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation and security control validation


• Support integration and engineering of endpoint, identity, cloud, network and infrastructure security controls with the SIEM and Defender ecosystem


• Build Sentinel Workbooks, platform health monitoring and KPI/KRI reporting


• Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures and support documentation


• Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting and technical support during critical incidents and major changes


• Proven experience in SIEM, detection or security platform engineering within a large enterprise environment


• Strong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity and Cloud


• Experience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation and contextual enrichment


• Experience onboarding infrastructure, cloud, application and security telemetry into a SIEM


• Practical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment and security control validation


• Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting and operational support


• Experience applying Detection-as-Code, CI/CD, source control and peer-review practices

Technical Skills:

• Microsoft Sentinel


• Identity


• Cloud


• KQL


• Analytics Rules


• Hunting


• Workbooks


• Playbooks


• Data Collection Rules


• Custom Tables


• Parsers


• Custom Ingestion


• Windows Event Forwarding and Collection


• XPath Filtering


• Windows Event IDs


• Sysmon


• PowerShell Logging


• Logic Apps


• REST APIs


• PowerShell


• Python


• MITRE ATT&CK


• Detection Coverage Analysis


• Git-Based CI/CD


• Cribl

Soft Skills:

• Proactive, accountable and delivery-focused approach


• Strong analytical, troubleshooting and problem-solving capability


• Clear communication with technical, operational and management stakeholders


• Effective collaboration across teams, regions and technical disciplines


• Calm, structured delivery under pressure, with disciplined documentation and prioritisation


• Willingness to provide planned out-of-hours support for critical upgrades and major changes when required

Qualifications:

• Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering or a related discipline


• SC-200 or AZ-500 desirable


• Additional cloud, SIEM, security engineering or automation certifications advantageous