SIEM Engineer

Myn; Greater London; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Hybrid working

Career growth

Certifications / learning

Job summary

Myn seeks a SIEM Content and Platform Engineer for a hybrid role based in London, with one day per month in the office. You will design, tune and deploy analytics rules, ingestions and detections across Microsoft Sentinel and Defender XDR, delivering reliable telemetry and secure integrations.

The role emphasises engineering discipline, CI/CD, and collaboration with Security Operations, Infra, Cloud and Applications to deliver scalable security monitoring and secure integrations.

Qualifications

• Proven SIEM or security platform engineering experience in a large enterprise.
• Strong hands-on Microsoft Sentinel and Defender XDR experience with advanced KQL.
• Experience onboarding infrastructure, cloud, application and security telemetry (Azure Monitor/Log Analytics).
• Experience with Detection-as-Code, CI/CD, source control and peer review.
• Security engineering skills: platform hardening, remediation and risk assessment.
• Clear communication with technical and management stakeholders; willing to provide planned out-of-hours support.
• Desirable: SC-200 or AZ-500 and Cribl experience.

Responsibilities

• Design, test, deploy and tune analytics rules, correlation logic and hunting queries aligned with MITRE ATT&CK.
• Engineer and optimise data connectors, ingestion pipelines and custom parsers.
• Set logging standards and governance for the detection engineering lifecycle.
• Automate security workflows with Logic Apps, Azure Functions, REST APIs, PowerShell and Python.
• Build Sentinel workbooks, platform health monitoring and KPI/KRI reporting.
• Lead platform enhancements, migrations and upgrades; support major changes and incidents.

Skills

Microsoft Sentinel

Defender XDR

KQL

Azure Monitor

Detection-as-Code

CI/CD

PowerShell

Windows Event Forwarding

Cribl

Azure Arc

Tools

Azure Arc

Cribl

PowerShell

Logic Apps

Job description

SIEM Content and Platform Engineer – Hybrid (London office 1 day per month)

Full-time | Cyber Security | Hybrid, with one day a month in the London office

About the role

If you like building detection systems that analysts trust and a SIEM platform that scales, this role is for you. You will join the Cyber Security team to improve the Proactive Security monitoring capability, working with Security Operations, Infrastructure, Cloud and Application teams. You will be the subject matter expert for Microsoft Sentinel and detection engineering, delivering reliable telemetry, high-fidelity detections and secure integrations across a large enterprise.

What you’ll be doing

• Design, test, deploy and tune analytics rules, correlation logic and hunting queries aligned with MITRE ATT&CK
• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations
• Set logging standards, onboarding patterns and governance for the detection engineering lifecycle
• Automate security workflows with Logic Apps, Azure Functions, REST APIs, PowerShell and Python
• Build Sentinel workbooks, platform health monitoring and KPI/KRI reporting for the Proactive Security function
• Lead platform enhancements, proofs of concept, migrations and upgrades, and support critical incidents and major changes

What we’re looking for

• Proven SIEM, detection or security platform engineering experience in a large enterprise (essential)
• Strong hands-on Microsoft Sentinel and Defender XDR experience across Endpoint, Identity and Cloud, including advanced KQL (essential)
• Experience onboarding infrastructure, cloud, application and security telemetry, with Azure Monitor Agent, Azure Arc and Log Analytics
• Experience with Detection-as-Code, including CI/CD, source control and peer review, plus Windows Event Forwarding, Sysmon and PowerShell logging
• Practical security engineering skills: platform hardening, vulnerability remediation, technical risk assessment and control validation
• Clear communication with technical and management stakeholders, calm delivery under pressure, and willingness to provide planned out-of-hours support for critical upgrades and major changes
• Desirable: SC-200 or AZ-500, plus Cribl experience

What you get

• Hands-on work with Azure technologies and cloud transformation projects
• Competitive compensation
• Career growth opportunities
• Access to continuous learning and certifications
• The chance to work on impactful cloud initiatives across various industries
• Hybrid working, with just one day a month in the London office

This role suits

A detection or platform engineer who enjoys treating security monitoring as an engineering discipline, with version control, peer review and measurable quality.