Tenant Rationalisation, SOC Assessment & Detection Lead

Matchtech; Greater London; Remote; GBP 100,000 - 150,000; Full time

Job summary

Matchtech Group is seeking a hands-on Tenant Rationalisation, SOC Assessment & Detection Lead to drive Microsoft security recommendations across a complex enterprise. The role demands deep expertise in Microsoft Sentinel, detection engineering, and SOC transformation, translating assessments into remediation plans and leading delivery while remaining hands-on.

The candidate will design detections, tune KQL queries, and coordinate across technical teams.

Qualifications

• Hands-on experience in designing and deploying Sentinel detections.
• Strong detection engineering and analytics skills.
• Experience leading SOC transformation initiatives.

Responsibilities

• Lead delivery of tenant rationalisation and security remediation activities.
• Design, build and optimise Microsoft Sentinel detections and analytics rules.
• Develop and tune KQL queries to improve threat detection coverage.
• Translate SOC assessment findings into a backlog.
• Coordinate implementation across technical teams.
• Validate security improvements and acceptance criteria.
• Support testing, stakeholder engagement and governance.

Skills

Microsoft Sentinel

KQL development

Analytics rules

SOC delivery

Azure security

Multi-tenant environments

Job description

Tenant Rationalisation, SOC Assessment & Detection Lead

SC Cleared | Outside IR35 (TBC) | Predominantly Remote

We're supporting a major security transformation programme and are looking for an experienced Tenant Rationalisation, SOC Assessment & Detection Lead to drive the implementation of Microsoft security recommendations across a complex enterprise environment.
This is a hands-on technical leadership role requiring deep expertise in Microsoft Sentinel, detection engineering, and SOC transformation. You'll be responsible for translating assessment outcomes into actionable remediation plans, leading delivery activity, and enhancing detection capabilities across multiple environments.

Key Responsibilities

• Lead delivery of tenant rationalisation and security remediation activities.
• Design, build and optimise Microsoft Sentinel detections and analytics rules.
• Develop and tune KQL queries to improve threat detection coverage.
• Translate SOC assessment findings into a prioritised delivery backlog.
• Coordinate implementation activities across technical teams.
• Validate security improvements and ensure agreed acceptance criteria are met.
• Support testing, stakeholder engagement and delivery governance.

Essential Skills & Experience

• Strong commercial experience with Microsoft Sentinel.
• Advanced KQL development and detection engineering expertise.
• Experience designing, building and tuning analytics rules and use cases.
• Security Operations Centre (SOC) delivery experience.
• Azure security and remediation experience.
• Experience working within complex or multi-tenant environments.
• Proven ability to lead technical delivery whilst remaining hands‑on.

Ideal Background

We would particularly like to hear from:

• Microsoft Sentinel Consultants
• Sentinel Technical Leads
• Detection Engineering Leads
• SIEM/SOC Consultants
• Microsoft Security Consultants

Candidates should be able to demonstrate that they have personally built and deployed detections, rather than simply administering or monitoring a Sentinel environment.

Security Requirements

To be considered, candidates must:

• Hold active SC Clearance
• Be a sole British national
• Be willing to attend site when required (potentially up to one day per week)

Contract Details

• Predominantly remote
• Initial engagement until March, with strong likelihood of extension
• Site attendance may occasionally be required
• Immediate interviews available

If you're a hands‑on Microsoft Sentinel expert with a strong background in detection engineering and SOC transformation, we'd love to hear from you.