SIEM Detection Engineer

Harvey Nash Plc; Reading; On-site; GBP 112,000 - 147,000; Full time

Job summary

Harvey Nash's client is seeking a SIEM Detection Engineer for Havant/Reading with hybrid work and a six-month engagement. The role requires SC clearance and a day rate up to £700.

You will lead onboarding of log sources into Microsoft Sentinel, build parsers, write KQL, and develop automation via Logic Apps and SOAR, while implementing CI/CD for SIEM content.

Qualifications

• SC clearance required to commence.
• Experience with SIEM and cloud security monitoring.
• Proficient in designing and tuning detections.
• Ability to develop automation in Logic Apps and playbooks.

Responsibilities

• Lead onboarding and integration of log sources into Microsoft Sentinel to ensure reliable telemetry.
• Develop parsers and data transformations to normalise ingested data.
• Design and optimise KQL queries to support threat detection and investigation.
• Create and maintain analytic rules and detection logic aligned to threats and use cases.
• Develop Logic Apps and SOAR workflows to automate response and reduce manual effort.
• Implement CI/CD pipelines to deploy SIEM content (rules, parsers, playbooks).
• Automate deployment across environments for consistency and speed.
• Tune detections to reduce false positives.

Skills

Sentinel onboarding

Log source integration

KQL queries

Detection logic design

SOAR workflows

CI/CD pipelines

Azure DevOps

Git

Tools

Microsoft Sentinel

Azure DevOps

Git

Job description

SIEM Detection Engineer - (Havant/Reading/Hybrid) - Inside IR35

Day Rate - up to £700

Duration - 6 months

Harvey Nash's Client have a requirement for a SIEM Engineer, you must be SC Cleared to commence this post. You will support the team in:

• Lead onboarding and integration of log sources into Microsoft Sentinel to ensure complete and reliable security telemetry


• Develop custom parsers and data transformations to normalise and enrich ingested data


• Design and optimise KQL queries to support effective threat detection and investigation


• Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases


• Develop Logic Apps and SOAR workflows to automate response and reduce manual effort


• Implement CI/CD pipelines (Azure DevOps/Git) to support controlled deployment of SIEM content (rules, parsers, playbooks)


• Automate deployment and configuration across environments to improve consistency and speed of delivery


• Perform ongoing tuning and optimisation of detections to improve fidelity and reduce false positives