SIEM Engineer (SC Cleared)

Lorien; Reading, Havant; On-site; GBP 111,000 - 166,000; Full time

Job summary

Lorien is seeking a SIEM Engineer (SC Cleared) for a Reading/Havant based 6-month contract. The role focuses on onboarding log sources into Microsoft Sentinel, developing parsers, and creating automated detection and response workflows.

Responsibilities include tuning KQL queries, building analytic rules, and deploying SIEM content via CI/CD pipelines to multiple environments. Strong familiarity with SOAR and Logic Apps is essential.

Qualifications

• Experience onboarding and integrating log sources into SIEM.
• Develop parsers and data transformations for normalisation.
• Design and tune KQL queries for detection.

Responsibilities

• Lead onboarding and integration of log sources into Microsoft Sentinel.
• Develop custom parsers and data transformations to normalise and enrich ingested data.
• Design and optimise KQL queries to support threat detection and investigation.
• Create and maintain analytic rules and detection logic for emerging threats.
• Develop Logic Apps and SOAR workflows to automate response.
• Implement CI/CD pipelines to deploy SIEM content across environments.
• Automate deployment and configuration for consistency and speed.
• Tune detections to reduce false positives and improve fidelity.

Skills

Threat detection

Incident response

Data normalization

Automation

Threat intelligence

Tools

Microsoft Sentinel

KQL

Logic Apps

SOAR

Azure DevOps

Git

Job description

Job Title: SIEM Engineer (SC Cleared)
Location: Reading/Havant
Duration:6 months
Description:

• Lead onboarding and integration of log sources into Microsoft Sentinel to ensure complete and reliable security telemetry
• Develop custom parsers and data transformations to normalise and enrich ingested data
• Design and optimise KQL queries to support effective threat detection and investigation
• Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases
• Develop Logic Apps and SOAR workflows to automate response and reduce manual effort
• Implement CI/CD pipelines (Azure DevOps/Git) to support controlled deployment of SIEM content (rules, parsers, playbooks)
• Automate deployment and configuration across environments to improve consistency and speed of delivery
• Perform ongoing tuning and optimisation of detections to improve fidelity and reduce false positives