SIEM Engineer

Trust In SODA; Reading; Hybrid; GBP 150,000 - 170,000; Full time

Benefits offered by this job

Hybrid work arrangement

Job summary

SSE is seeking a specialist SIEM Engineer with active SC clearance to enhance and automate its Microsoft Sentinel platform. You will onboard log sources, build parsers, optimise KQL queries and design detection logic.

The role involves developing Logic Apps/Playbooks and setting up CI/CD pipelines for secure deployments across environments. The position is hybrid in Hampshire, initially 6 months with extension potential, focusing on reducing false positives, improving monitoring, and supporting

Qualifications

• Active_SC Clearence required
• Strong MS Sentinel engineering and optimisation experience
• Log source onboarding and data normalisation
• Advanced KQL development and detection logic design
• SOAR automation and Playbooks
• CI/CD pipelines via Azure DevOps/Git

Responsibilities

• Onboard and integrate log sources into Sentinel; build custom parsers and data transformations
• Design and optimise KQL queries; build and tune analytic rules and detection logic
• Develop Logic Apps/SOAR workflows to automate response
• Implement CI/CD pipelines (Azure DevOps/Git) for SIEM content deployment
• Automate deployment/config across environments; tune detections to reduce false positives

Skills

SC Clearance

Microsoft Sentinel

KQL

SOAR automation

CI/CD

Azure DevOps

Git

Incident response

Tools

Azure DevOps

Git

Logic Apps

Job description

SIEM Engineer (SC Cleared Contractor)

Rate: Up to £700/day Insire IR35

Clearance: Active SC Clearance (Essential)

Location: Hybrid, Hampshire

Contract: Initial 6 Months with potential extension

Specialist SIEM Engineer needed to develop, optimise and automate SSE's Microsoft Sentinel platform, supporting security monitoring, detection engineering and Project Amur/ECAF compliance.

Scope

• Onboard and integrate log sources into Sentinel; build custom parsers and data transformations
• Design and optimise KQL queries; build and tune analytic rules and detection logic
• Develop Logic Apps/SOAR workflows to automate response
• Implement CI/CD pipelines (Azure DevOps/Git) for SIEM content deployment
• Automate deployment/config across environments; tune detections to reduce false positives

Key Skills

• Active SC Clearance (Essential)
• Strong Microsoft Sentinel engineering, administration and optimisation experience
• Log source onboarding, custom parsers and data normalisation
• Advanced KQL development and optimisation
• Analytic rule/detection logic design and tuning
• Logic Apps, Playbooks and SOAR automation
• Azure DevOps/Git CI/CD pipeline implementation
• Strong grounding in security monitoring, incident response and threat hunting
• Strong troubleshooting and root cause analysis skills

Desirable

• SANS SEC503 – Network Monitoring and Threat Detection

Candidates must hold active, valid SC Clearance.