SIEM Engineer

The Trust; Kingsley; Hybrid; GBP 77,000 - 129,000; Full time

Job summary

The Trust is seeking a SIEM Engineer (SC Cleared Contractor) to join on a hybrid basis in Hampshire. You will onboard log sources into Microsoft Sentinel, build parsers, and optimise KQL queries while developing SOAR workflows to automate responses. The role requires active SC clearance and hands-on Sentinel expertise.

The contract spans initial 6 months with potential extension. This contractor position offers up to £700/day, with a hybrid work arrangement in Hampshire, focusing on security

Qualifications

• Active SC Clearance required.
• Strong Microsoft Sentinel engineering, administration and optimisation experience.
• Log source onboarding, custom parsers and data normalisation.

Responsibilities

• Onboard log sources into Microsoft Sentinel and build custom parsers.
• Design and optimise KQL queries and detection logic.
• Develop Logic Apps/SOAR workflows to automate responses.

Skills

SC Clearance

Microsoft Sentinel

KQL

Logic Apps/SOAR

CI/CD

Azure DevOps

Threat hunting

Troubleshooting

Tools

Azure DevOps

Git

Job description

SIEM Engineer (SC Cleared Contractor) Rate: Up to £700/day Insire IR35 Clearance: Active SC Clearance (Essential) Location: Hybrid, Hampshire Contract: Initial 6 Months with potential extension Specialist SIEM Engineer needed to develop, optimise and automate SSE's Microsoft Sentinel platform, supporting security monitoring, detection engineering and Project Amur/ECAF compliance. ScopeOnboard and integrate log sources into Sentinel; build custom parsers and data transformationsDesign and optimise KQL queries; build and tune analytic rules and detection logicDevelop Logic Apps/SOAR workflows to automate responseImplement CI/CD pipelines (Azure DevOps/Git) for SIEM content deploymentAutomate deployment/config across environments; tune detections to reduce false positivesKey SkillsActive SC Clearance (Essential)Strong Microsoft Sentinel engineering, administration and optimisation experienceLog source onboarding, custom parsers and data normalisationAdvanced KQL development and
optimisationAnalytic rule/detection logic design and tuningLogic Apps, Playbooks and SOAR automationAzure DevOps/Git CI/CD pipeline implementationStrong grounding in security monitoring, incident response and threat huntingStrong troubleshooting and root cause analysis skillsDesirableSANS SEC503 - Network Monitoring and Threat DetectionCandidates must hold active, valid SC Clearance.