SIEM Data Onboarding - Sentinel

Capgemini; Pune District, Bengaluru, Delhi, Gurugram District; Hybrid; INR 700,000 - 1,100,000; Full time

Job summary

Capgemini is seeking a skilled SIEM Engineer with hands-on experience in Microsoft Sentinel to support enterprise security monitoring, data onboarding, use case development, and incident detection initiatives. The role focuses on integrating diverse log sources, developing and tuning detection use cases, and monitoring security events to enhance the overall effectiveness of the SIEM platform.

The candidate will work with SOC, Threat Hunting, and Incident Response teams to create dashboards and

Qualifications

• 4+ years of experience in SIEM engineering or security operations.
• Hands-on experience with Microsoft Sentinel.
• Experience in data onboarding, log source integration, and connector configuration.
• Strong knowledge of KQL and security analytics.

Responsibilities

• Configure, administer, and optimize Microsoft Sentinel environments.
• Onboard and integrate log sources from cloud, network, security, and endpoint platforms.
• Develop and tune detection use cases, analytics rules, and alerting mechanisms.
• Monitor SIEM alerts and security events to identify potential threats and suspicious activities.
• Create dashboards, workbooks, and reports to improve security visibility.
• Perform use case validation, tuning, and false-positive reduction.
• Develop and optimize KQL queries for threat detection and investigations.
• Work closely with SOC, Threat Hunting, and Incident Response teams.
• Configure and maintain automation workflows using Sentinel playbooks and SOAR capabilities.
• Support security monitoring use cases aligned with MITRE ATT&CK framework.
• Troubleshoot data ingestion, parsing, normalization, and connector-related issues.

Skills

Microsoft Sentinel

SIEM Monitoring

Data Onboarding

Correlation Rules

KQL

Azure Monitor & Log Analytics

Tools

Sentinel Playbooks

SOAR Automation

Job description

Location - PAN India

We are seeking a skilled SIEM Engineer with hands-on experience in Microsoft Sentinel to support enterprise security monitoring, data onboarding, use case development, and incident detection initiatives. The ideal candidate will be responsible for integrating diverse log sources, developing and tuning security use cases, monitoring security events, and improving the overall effectiveness of the SIEM platform.

Primary Skills

• Microsoft Sentinel
• SIEM Monitoring
• Data Onboarding & Integration
• Use Case Development & Tuning

Secondary Skills

• Microsoft Defender XDR
• KQL (Kusto Query Language)
• Incident Investigation
• Threat Hunting
• Azure Monitor & Log Analytics
• SOAR Automation

Key Responsibilities

• Configure, administer, and optimize Microsoft Sentinel environments.
• Onboard and integrate log sources from cloud, network, security, and endpoint platforms.
• Develop, implement, and tune detection use cases, analytics rules, and alerting mechanisms.
• Monitor SIEM alerts and security events to identify potential threats and suspicious activities.
• Create dashboards, workbooks, and reports to improve security visibility.
• Perform use case validation, tuning, and false-positive reduction.
• Develop and optimize KQL queries for threat detection and investigations.
• Work closely with SOC, Threat Hunting, and Incident Response teams.
• Configure and maintain automation workflows using Sentinel playbooks and SOAR capabilities.
• Support security monitoring use cases aligned with MITRE ATT&CK framework.
• Troubleshoot data ingestion, parsing, normalization, and connector-related issues.

Required Skills & Qualifications

• 4+ years of experience in SIEM engineering or security operations.
• Strong hands-on experience with Microsoft Sentinel.
• Experience in data onboarding, log source integration, and connector configuration.
• Expertise in SIEM monitoring, alert analysis, and security event investigation.
• Experience creating and tuning correlation rules and detection use cases.
• Strong knowledge of KQL (Kusto Query Language).
• Understanding of security operations, incident response, and threat detection methodologies.
• Experience with Azure Monitor, Log Analytics, and Microsoft Security solutions.