Lead Platform Engineer, SIEM & Detection Architect

Axonect; Kuala Lumpur; On-site; MYR 180,000 - 240,000; Full time

Job summary

Axonect is seeking a Senior SIEM Engineer in Kuala Lumpur to own the detection engineering lifecycle for Microsoft Sentinel. You will translate attacker TTPs into telemetry, map detections to MITRE ATT&CK, and collaborate with Red Team to validate and improve playbooks.

The role involves designing data requirements, building KQL logic, and deploying automated, CI/CD-driven improvements across the platform. Strong cloud identity and scripting skills are essential.

Qualifications

• Hands-on with Microsoft Sentinel, KQL, ASIM, Logic Apps, Content Hub and Watchlists
• Experience partnering with Red Team and running Purple Team validations
• Translate attacker TTPs into telemetry and high-fidelity detections
• CI/CD for SIEM using Git and Azure DevOps; Detection-as-Code and promotions
• Scripting for automation (PowerShell/Python) and API integrations

Responsibilities

• Convert Red Team and adversary simulation insights into formal detection enhancements
• Map detections to MITRE ATT&CK, define telemetry requirements, and validate log sources & enrichments
• Post-engagement gap analysis, prioritize fixes in backlog
• Update triage guidance and analyst notes
• Logic Apps playbook enhancements; testing with Red Team; CI/CD deployment; retirement/archive

Skills

Microsoft Sentinel

KQL

ASIM

Logic Apps

PowerShell

Python

Git

Azure DevOps

Tools

Content Hub

Watchlists

Workbooks

Job description

Axonect is seeking a Senior SIEM Engineer in Kuala Lumpur to own the detection engineering lifecycle for Microsoft Sentinel. You will translate attacker TTPs into telemetry, map detections to MITRE ATT&CK, and collaborate with Red Team to validate and improve playbooks.

The role involves designing data requirements, building KQL logic, and deploying automated, CI/CD-driven improvements across the platform. Strong cloud identity and scripting skills are essential.