DTICI_MS Sentinel Specialist (SIEM Engineer)_T8_Senior Consultant

Own Retail; Bengaluru; On-site; INR 1,400,000 - 2,100,000; Full time

Job summary

Own Retail in Bengaluru is seeking a skilled security analyst to configure and operate Microsoft Sentinel/ Defender for monitoring and alert investigations. You will craft Sentinel playbooks and dashboards, ingest and parse Syslog data and network feeds, and support hybrid cloud security in Azure and AWS.

The role requires 4–7 years in cyber security with SIEM focus, familiarity with SOC runbooks, and strong communication to collaborate with IT and security stakeholders.

Qualifications

• Bachelor's degree or higher in a related field.
• 4–7 years of cyber security experience focusing on SIEM technologies.
• Knowledge of cloud security in Azure/AWS and hybrid environments.
• Familiarity with SOC operations, runbooks, and incident response.

Responsibilities

• Configure and operate Sentinel and Defender for continuous security monitoring.
• Create Sentinel playbooks and dashboards for platform monitoring.
• Ingest and parse Syslog data and network devices via APIs.
• Work with Azure, AWS, and hybrid environments from a security perspective.
• Develop dashboards and workbooks in Sentinel using KQL and Azure Monitor Logs.
• Assist with alert tuning to improve detection accuracy and reduce false positives.
• Support security documentation, runbooks, and CSOC incident investigations.

Skills

SOC operations

Security monitoring

Incident analysis

Communication

Team collaboration

Azure/AWS security concepts

KQL basics

Data parsing

Log ingestion

Education

Bachelor’s degree in computer science/IT/Ccyber security

Tools

Microsoft Sentinel

Microsoft Defender

Azure Monitor Logs

Sentinel Playbooks

AWS security

Splunk/QRadar/ArcSight (basic)

Job description

Key Tasks & Responsibilities:

• Configure and operate Microsoft Sentinel and Microsoft Defender for continuous security monitoring and alert investigation.
• Creation of Sentinel Playbooks & dashboards for platform monitoring.
• Ingesting of various types of Syslog data, Network devices via Api's etc. along with proper parsing of incoming data.
• Hands‑on experience working with Azure and AWS cloud environments, supporting security monitoring and investigation activities.
• Develop and maintain basic to intermediate dashboards and workbooks in Sentinel using KQL, Azure Monitor Logs, and security metrics.
• Perform alert tuning activities to improve detection accuracy and reduce false positives, under guidance from senior engineers.
• Support documentation activities including security procedures, operational guidelines, and runbooks for SOC use.
• Participate in incident investigations and provide analysis support as part of CSOC processes.

Key Skills:

• Strong working knowledge of Microsoft Sentinel, Microsoft Defender, and related Microsoft security tools.
• Assist with administration and operational support of Azure, AWS, and hybrid environments from a security perspective.
• Good understanding of Azure architecture concepts, including compute, networking, storage, and Microsoft Entra ID.
• Exposure to ingesting and parsing log sources such as Syslog, network devices, and cloud services.
• Familiarity with custom connectors, scripts, or integrations for onboarding security data sources.
• Understanding of SOC operations, alert lifecycle, and investigation workflows.
• Experience working with SOC runbooks and operational documentation.
• Basic exposure to other SIEM platforms such as Splunk, QRadar, or ArcSight is an advantage.
• Good communication and collaboration skills, with the ability to work effectively with SOC teams, IT, and security stakeholders.

• Bachelor’s degree in computer science, Information Technology, Cyber Security, or a related field.
• Minimum of 4 to 7 years of experience in cyber security, with a focus on SIEM technologies
• Certifications:
  • SC‑200: Microsoft Security Operations Analyst
  • SC‑300 / SC‑100 (foundational exposure)
  • CISSP / CISM (foundational knowledge or pursuing)