Snr Cybersecurity Consultant Engineer (Architecture, Infrastructure and Remediation)

LevelBlue, LLC.; United States; Hybrid; USD 140,000 - 180,000; Full time

Job summary

LevelBlue, LLC. is seeking a Senior Cybersecurity Consultant to deliver client-facing SIEM engineering, Microsoft security advisory and implementation, and security operations optimization. This is not an analyst role.

You will own design and build work on live engagements: analytics, detection logic, security integrations, and client‑ready delivery artifacts. You will run workshops and provide SME‑level guidance to both technical and non‑technical stakeholders, delivering practical,

Qualifications

• Senior consultant with client workshops and engagement scoping experience.
• Hands‑on Microsoft Sentinel engineering in production: analytic rules, tuning, use‑case operationalization.
• Experience producing detection design records (AIR DDRs).
• Hands‑on Defender XDR in a detection or SOC integration context.
• Hands‑on Purview configuration in security/compliance monitoring.

Responsibilities

• Lead SIEM design and implementation for greenfield brownfield SOC builds.
• Design and build custom detection content aligned to threat profiles.
• Integrate and operationalize Defender XDR.
• Provide guided implementation for Purview and related controls.
• Create client‑ready design/build artifacts and run workshops.

Skills

Senior consulting / professional‑svc.

Sentinel engineering

AIR DDRs / detection design

Defender XDR integration

Purview configuration

Tools

KQL

Logic Apps

Job description

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure‑play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI‑powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.

Primary platform: Microsoft Sentinel (analytic rule design and build). Additional SIEM experience (Splunk or SentinelOne AI SIEM) is valued. This is not a monitoring-only or general cyber advisory seat.

About the Role

LevelBlue’s Professional Services Organization is hiring a Senior Cybersecurity Consultant for client‑facing delivery across SIEM engineering, Microsoft security advisory and implementation, and security operations optimization. This is not an analyst role. You will own design and build work on live engagements: analytics, detection logic, security integrations, technical advisory, and client‑ready delivery artifacts. You will run workshops, provide SME‑level guidance for technical and non‑technical stakeholders, and leave clients with something they can operate. You will operate independently and in mixed teams, manage your own work across concurrent clients, and improve practice proposals and delivery assets.

Role Expectations / Key Responsibilities

Engagement Delivery

• Deliver engagements across a range of service lines. Lead SIEM design and implementation on greenfield SOC builds and brownfield optimization: data‑source onboarding (e.g., telemetry analysis, ingestion design, parsing and normalization, custom connectors), analytics rules, hunting queries, automation rules and playbooks, workbooks, incident process alignment, and use‑case documentation.
• Design and build custom detection content aligned to the client’s threat profile and available telemetry.
• Integrate and operationalize Microsoft Defender XDR.
• Assess requirements and advise on best‑practice implementation and configuration for Microsoft Purview, Entra ID, Defender for Cloud, Azure security, Copilot. Deliver guided implementation and hands‑on configuration when required.
• Microsoft Purview: you can discover client requirements, recommend a target configuration, and explain how to implement it (information protection, DLP, audit, or related controls as relevant). Hands‑on build is desirable.
• Build practical automation where it improves response quality: Sentinel automation rules, Logic Apps, and analyst response actions.
• Produce client‑ready design and build artifacts: for example, use case catalog, automation/playbook designs, implementation plans, gap analyses, tactical maturity roadmaps with executive summaries.
• Facilitate workshops and discussion sessions; capture requirements, decisions, risks, and scope changes.
• Support pre‑sales with effort estimates, technical scope, and solution shaping.

Experience & Qualifications

Required

• Senior consulting or professional‑services delivery (not only an internal SOC or engineering seat): you have owned client workshops around business requirements and use case discovery, engagement scope, and signed‑off deliverables.
• Hands‑on Microsoft Sentinel engineering in production, including analytic rule design and build, query tuning and optimization, false‑positive reduction, and use‑case operationalization.
• Experience producing detection design records (AIR DDRs): our use case notes covering use case scenarios, data sources, KQL, tuning notes.
• Hands‑on Microsoft Defender XDR (at least Defender for Endpoint plus one of Identity / Office / Cloud Apps) in a detection or SOC‑integration context.
• Hands‑on Microsoft Purview configuration in a security or compliance context connected to monitoring or control design.

Useful

• Firewall / network security configuration reviews (policy quality, logging to SIEM, segmentation relevant to detections).
• Active Directory security reviews (beyond detections): privileged access, delegation, hardening, hybrid identity.
• Azure security reviews (beyond Defender for Cloud / Sentinel): landing‑zone and control‑plane hygiene.
• AWS security reviews or multi‑cloud posture work.
• Splunk or SentinelOne (working knowledge).
• Broader control reviews that feed a security operations or threat detection and response roadmap.

Certifications (desirable)

• Most relevant: SC-200; SC-500 (AZ-500)
• Also useful: SC-100, SC-300, SC-400; Splunk ES Admin or Splunk Architect; GIAC detection/IR (e.g. GCIA, GCIH); CISSP

About LevelBlue

LevelBlue is a leading cybersecurity and managed security services provider focused on threat detection and response. Leveraging our Fusion platform, global threat intelligence, and deep expertise across offensive and defensive security disciplines, we help organizations across financial services, retail, healthcare, government, and utilities manage risk and respond to the threats that matter most.

Our Professional Services practice works alongside clients at every stage of their security maturity – from strategy and architecture through to hands‑on delivery, operations uplift, and incident response. We are a team of practitioners who have built and run security programs ourselves, and we bring that credibility to every engagement.

This role is open to candidates legally authorized to work in the United States. At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs.

LevelBlue is committed to a culture of respect, inclusion, and equal opportunity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law.