Senior SIEM Engineer: Sentinel Detections & Automation

Expleo Group; Porto; Presencial; EUR 42 000 - 66 000; Tempo integral

Resumo da oferta

Expleo Group is seeking a Security Engineer specializing in Microsoft Sentinel to administer and optimize monitoring environments in Porto, Portugal. You will develop detection rules, manage diverse log sources, and automate workflows using PowerShell, Bash, Python, and Ansible.

You will collaborate with infrastructure, network, and security teams to improve coverage, reduce false positives, and maintain technical documentation for operating procedures.

Qualificações

• Experience administering Microsoft Sentinel environments.
• Ability to develop and optimize detection rules and queries (KQL).
• Experience integrating and managing log sources and security telemetry.

Responsabilidades

• Administration, implementation, and optimization of Microsoft Sentinel environments.
• Development and optimization of detection rules and KQL queries.
• Integration and management of log sources and security telemetry.
• Hands-on experience with Graylog, Logstash, Syslog-ng, NXLog, Windows Event Forwarding (WEF), and Syslog.
• Automation using PowerShell, Bash, Python, and/or Ansible.
• Management of Linux environments and security infrastructure.
• Experience with Docker/Podman and containerized environments.
• Improving monitoring coverage and reducing false positives.
• Collaboration with infrastructure, network, and security teams.
• Production and maintenance of technical documentation and operational procedures.

Conhecimentos

Microsoft Sentinel administration

KQL queries

Log management

Ferramentas

Graylog

Logstash

Syslog-ng

NXLog

Windows Event Forwarding

Syslog

PowerShell

Bash

Python

Ansible

Docker/Podman

Descrição da oferta de emprego

Expleo Group is seeking a Security Engineer specializing in Microsoft Sentinel to administer and optimize monitoring environments in Porto, Portugal. You will develop detection rules, manage diverse log sources, and automate workflows using PowerShell, Bash, Python, and Ansible.

You will collaborate with infrastructure, network, and security teams to improve coverage, reduce false positives, and maintain technical documentation for operating procedures.