Sentinel Engineer: Threat Detection & Ingestion Lead

SkyeBiz; United States; Remote; USD 135,000 - 155,000; Full time

Job summary

SkyeBiz in the United States is seeking a skilled Sentinel Engineer to join our cybersecurity team. The role spans log sources integration, data connectors deployment, and tuning ingestion and detection engineering with KQL analytics, hunting queries, and MITRE ATT&CK mappings.

You will lead log integration on onboarding projects, drive technical engagement, configure audit settings, deploy Function Apps, and optimize costs while collaborating with client teams and Azure DevOps pipelines.

Qualifications

• Minimum 2 years hands-on Sentinel design and implementation experience.
• Minimum 5 years total cybersecurity experience (engineering, operations or detection).
• Strong proficiency in KQL (Kusto Query Language).
• Hands-on Linux system administration experience.
• Solid networking fundamentals.
• Experience deploying and managing Azure Arc and AMA, including DCRs.
• Experience with syslog collection architectures and Windows event collection.
• Experience operating in multi-tenant Azure environments.
• Strong knowledge of Microsoft Entra ID and Active Directory logging.
• Experience with Microsoft Defender XDR and Sentinel–Defender integration.
• Familiarity with Sentinel content surface (Content Hub, analytics rules, workbooks, watchlists, threat intel connectors).
• Proficiency in PowerShell/Python scripting.
• Experience with Git workflows and IaC.
• Excellent problem-solving and communication abilities.

Responsibilities

• Act as the technical lead for log integration on client onboarding projects—owning the engineering end-to-end.
• Drive scoping, sequencing and tracking of log integration workstreams; engage client infrastructure when needed.
• Research, test and advise on audit configuration settings for log sources to ensure proper logs for detection.
• Deploy data connectors and troubleshoot ingestion; customize Function Apps as required.
• Prototype integrations for new log sources and create repeatable template configurations for clients.
• Validate parsers, fix and enhance, and optimise log collection for cost efficiency.
• Develop and maintain Sentinel analytics rules, hunting queries and workbooks.
• Engage with client cybersecurity professionals on detection strategy and use-case prioritisation.

Skills

KQL

Linux

Networking

PowerShell/Python

Git workflows

Threat detection

MITRE ATT&CK

Detection engineering

Communication

Multi-client management

Tools

Azure DevOps

REST APIs

Cribl Stream

SIEM tools

Job description

SkyeBiz in the United States is seeking a skilled Sentinel Engineer to join our cybersecurity team. The role spans log sources integration, data connectors deployment, and tuning ingestion and detection engineering with KQL analytics, hunting queries, and MITRE ATT&CK mappings.

You will lead log integration on onboarding projects, drive technical engagement, configure audit settings, deploy Function Apps, and optimize costs while collaborating with client teams and Azure DevOps pipelines.