Azure Cloud Sentinel Engineer

Experis; Marietta (GA); On-site; USD 140,000 - 170,000; Full time

Job summary

Experis is seeking an Azure Cloud Sentinel Engineer to support a federal government program in Marietta, GA. The role is 100% onsite with a contract-to-hire path, focusing on hands-on detection engineering in a GovCloud Azure environment.

You will own Microsoft Sentinel end-to-end: onboarding data sources, tuning KQL analytics, building automated playbooks, and hunting threats alongside the SOC. A strong background in Azure security and zero-trust practices is required.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 5+ years cybersecurity experience with substantial hands-on Microsoft Sentinel administration and engineering.
• Hands-on within last 12 months with: Microsoft Sentinel, Azure Log Analytics, KQL, Azure Logic Apps, Defender suite, Azure security/identity services.
• PAM and IAM concepts.
• CI/CD security and application security scanning.
• Configuring and securing enterprise Azure environments.
• Knowledge of Zero Trust architecture and cloud security best practices.
• US Citizen or Green Card holder with 3+ years US residence and work history; federal background check required; on-site in Marietta, GA five days/week.

Responsibilities

• Design, implement, and maintain Microsoft Sentinel SIEM/SOAR.
• Onboard and manage security data sources into Azure Log Analytics (Syslog, CEF, REST APIs, threat intel).
• Write and tune KQL queries, analytics rules, alerts, and workbooks.
• Build automated response playbooks with Azure Logic Apps.
• Perform threat hunting, incident investigation, and response with SOC teams.
• Implement Azure security controls aligned to Zero Trust.
• Assess vulnerabilities, analyze attacker TTPs, and drive remediation.
• Support governance, compliance, and audit activity across FedRAMP and FISMA requirements.

Skills

Microsoft Sentinel administration

KQL (Kusto)

Azure Logic Apps

Microsoft Defender suite

Azure security services

PAM and IAM concepts

Threat hunting

Zero Trust architecture

Education

Bachelor’s degree in Cybersecurity/CS/IT

Tools

Azure Log Analytics

Syslog/CEF data onboarding

REST APIs integration

Threat intelligence feeds

Job description

Azure Cloud Sentinel Engineer (Information Security IV)

Marietta, GA — 100% onsite, 5 days/week

1-Year Contract to Hire

US Citizen or Green Card holder required — federal background check

About The Role

Our client, a Fortune 500 financial technology company, is hiring an Azure Sentinel Engineer to support a federal government program. This is hands-on detection engineering in an Azure Government (GovCloud) environment — building the security monitoring capability, not triaging alerts on someone else's.

You’ll own Microsoft Sentinel end to end: onboarding data sources, writing and tuning KQL analytics rules, building automated response playbooks, and hunting threats alongside the SOC. The program operates under FedRAMP and FISMA, so security work here is measured against real federal controls.

What You’ll Do

• Design, implement, and maintain Microsoft Sentinel SIEM/SOAR
• Onboard and manage security data sources into Azure Log Analytics — Syslog, CEF, REST APIs, threat intelligence feeds
• Write and tune KQL queries, analytics rules, alerts, and workbooks
• Build automated response playbooks with Azure Logic Apps
• Perform threat hunting, incident investigation, and response with SOC teams
• Implement Azure security controls aligned to Zero Trust
• Assess vulnerabilities, analyze attacker TTPs, and drive remediation
• Support cloud security governance, compliance, and audit activity across FedRAMP and FISMA requirements
• Provide security architecture guidance on cloud security strategy

Required

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field
• 5+ years cybersecurity experience with substantial hands-on Microsoft Sentinel administration and engineering
• Hands‑on, current experience (within the last 12 months) with: Microsoft Sentinel, Azure Log Analytics, Kusto Query Language (KQL), Azure Logic Apps, Microsoft Defender suite, Azure security and identity services
• Privileged Access Management (PAM) and Identity and Access Management concepts
• CI/CD security and application security scanning
• Configuring and securing enterprise Azure environments
• Working knowledge of Zero Trust architecture and cloud security best practices
• US Citizen or Green Card holder with 3+ years continuous US residence and work history. No offshore work within that window. Federal background check required — allow 4–8 weeks.
• Willing and able to work onsite in Marietta, GA five days per week
• Open to converting to full‑time employment with the client

Preferred

• Azure Government (GovCloud) experience
• FISMA, FedRAMP, and NIST 800-53 compliance experience
• Certifications: SC-200, AZ-500, SC-100, CISSP, CCSP — current, not lapsed
• Microsoft Defender XDR: Defender for Endpoint, Office 365, Identity, Cloud Apps
• Data protection: Microsoft Purview, MIP, DLP, Key Vault
• Identity: Entra ID, PIM, Conditional Access, Azure Lighthouse
• Experience migrating an organization from Splunk, QRadar, ArcSight, or LogRhythm onto Sentinel
• Prior work with government clients, auditors, and executive stakeholders

Why This Role

Greenfield security work on a federal program with real mission weight, on a team that is actively growing. Contract to hire with a clear path to permanent employment.