Sentinel Engineer: Detection & Ingestion Specialist

SkyeBiz; Washington (District of Columbia); On-site; USD 135,000 - 155,000; Full time

Job summary

SkyeBiz is seeking a skilled Sentinel Engineer to join our cybersecurity team in the USA. The role covers log integration, data connectors, and detection engineering using Sentinel, MITRE ATT&CK mappings, and KQL.

Expect building hunting queries, tuning detections, and translating threat intel into deployable rules. This hands-on position requires at least 2 years of Sentinel design experience and 5 years in cybersecurity.

Qualifications

• Minimum 2 years hands-on Sentinel design and implementation.
• Minimum 5 years total cybersecurity experience (engineering/ops/detection).
• Strong proficiency in KQL.
• Linux system administration experience.
• Solid networking fundamentals.
• Experience deploying Azure Arc and AMA, including DCRs.
• Experience with Windows event collection and syslog architectures.
• Experience in multi-tenant Azure environments and Entra ID logging.
• Detection-engineering experience and scripting (PowerShell/Python).
• Familiarity with MITRE ATT&CK and threat intel to detections.

Responsibilities

• Act as the technical lead for log integration on client onboarding projects.
• Scope log integration workstreams, sequence work, and track progress.
• Research, test, and advise on audit config to ensure logs flow to Sentinel.
• Deploy data connectors and troubleshoot data ingestion and Function Apps.
• Develop and maintain Sentinel analytics rules and hunting queries.
• Engage with client security teams on detection strategy and use-case prioritisation.
• Translate threat intel into deployable detections and IaC workflows.
• Collaborate using Azure DevOps and maintain governance across clients.

Skills

KQL

Linux admin

Networking basics

PowerShell/Python

Git workflows

Detection engineering

Threat hunting

Multi-tenant Azure

Education

Microsoft certifications (SC-200, AZ-104, AZ-500, SC-100)

Tools

Azure DevOps

REST APIs

ASIM

Codeless Connector Framework (CCF)

Cribl Stream

Sigma rules

Job description

SkyeBiz is seeking a skilled Sentinel Engineer to join our cybersecurity team in the USA. The role covers log integration, data connectors, and detection engineering using Sentinel, MITRE ATT&CK mappings, and KQL.

Expect building hunting queries, tuning detections, and translating threat intel into deployable rules. This hands-on position requires at least 2 years of Sentinel design experience and 5 years in cybersecurity.