Software Developer - Microsoft Sentinel

Cyberobotix; Austin (TX); On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Competitive salary

Flexible work environment

Job summary

A technology services firm in Austin is looking for a Software Developer specializing in Microsoft Sentinel. The role focuses on automation in security operations, including creating playbooks and developing detection models. Candidates should have significant experience with Microsoft Sentinel and be proficient in Azure services. The position offers opportunities for technical leadership and collaboration in a cybersecurity context. If you have a strong software development background and relevant experience, we encourage you to apply.

Qualifications

• 2 years of full-time experience in software development or cybersecurity engineering.
• Hands-on experience with Microsoft Sentinel for 3+ years.
• Experience with developing UEBA models and behaviour-based analytics.

Responsibilities

• Designs and deploys Sentinel SOAR automation playbooks.
• Integrates Sentinel with third-party systems for automation.
• Develops and evaluates UEBA detection rules and analytics content.

Skills

Building Logic App workflows and custom Sentinel automation playbooks

Writing complex KQL queries for analytics, hunting, and behavioural detection

Developing custom connectors, data maps, and parsers

Designing and optimizing UEBA detection models

Education

Bachelor's degree in computer science or related field

Tools

Microsoft Sentinel

Azure cloud services

Python

PowerShell

DevOps tools

Job description

Job Title: Software Developer - Microsoft Sentinel

Contract: C2C

Location: Austin, TX [Only Local]

Overview

The Software Developer performs advanced (senior‑level) software development work focused on designing, building, testing, and optimizing Microsoft Sentinel capabilities for DSHS projects. This role is responsible for developing custom automation playbooks, analytics rules, behavioural models, connectors, and integrations to support SOAR and UEBA functionality. The position works under limited supervision with considerable latitude for initiative, independent judgment, and technical leadership.

Essential Job Functions (EJFs)

• Designs, develops, tests, and deploys Sentinel SOAR automation playbooks using Azure Logic Apps, Azure Functions, ARM templates, and REST APIs.
• Creates automated workflows for alert enrichment, triage, response actions, notification processes, and case management.
• Integrates Sentinel with third‑party systems (EDR, IAM, ticketing systems, email gateways, firewalls, etc.) to automate security operations.
• Develops custom UEBA detection rules, anomaly models, ML‑based behaviour patterns, and advanced hunting queries (KQL).
• Builds and maintains analytics content, data parsers, normalization rules, and entity behaviour profiles.
• Evaluates behavioural anomalies and collaborates with cybersecurity teams to fine‑tune detection logic.
• Designs and implements custom data connectors, ingestion pipelines, and data transformation logic.
• Creates dashboards, workbooks, hunting queries, and detection‑as‑code assets.
• Performs platform tuning to improve performance, reduce noise, and align to MITRE ATT&CK and Zero Trust principles.

Application Development & Integration (10%)

• Develops supporting code modules, scripts, microservices, and helper APIs using Python, PowerShell, .NET, or similar languages.
• Works with DevOps pipelines, CI/CD processes, version control, and infrastructure‑as‑code where applicable.
• Writes technical design documents, SOPs, architecture diagrams, and automation runbooks.
• Collaborates with DSHS, HHSC CISO Office, and cross‑functional stakeholders on requirements, testing, and deployment.
• Provides Tier III support for Sentinel engineering issues and participates in after‑action reviews when needed.

Knowledge, Skills, and Abilities (KSAs)

Knowledge of:

• Microsoft Sentinel architecture, SOAR, and UEBA capabilities.
• Azure cloud services, Logic Apps, Azure Functions, Event Hubs, Key Vault, and Azure AD.
• Security operations processes (triage, threat detection, incident response, threat modeling).
• MITRE ATT&CK, NIST CSF, Zero Trust Architecture concepts.
• CI/CD pipelines, DevOps practices, and Git‑based version control.
• API integrations and JSON/YAML structures.

Skills in

• Building Logic App workflows and custom Sentinel automation playbooks.
• Writing complex KQL queries for analytics, hunting, and behavioural detection.
• Developing custom connectors, data maps, and parsers.
• Designing and optimizing UEBA detection models.
• Debugging SOAR workflows and resolving integration issues.
• Communicating technical information clearly to both technical and non‑technical audiences.

Abilities to

• Work independently and take ownership of complex development tasks.
• Translate security requirements into scalable technical solutions.
• Analyze threat behaviours and develop meaningful detections.
• Work collaboratively with cybersecurity, infrastructure, and application teams.
• Manage multiple work assignments and meet deadlines.

Requirements

• Graduation from an accredited four‑year college or university with major coursework in computer science, computer information systems, software engineering, cybersecurity, or a related field.
• Required Two (2) years of full‑time experience in software development, cloud engineering, SIEM engineering, or cybersecurity engineering.
• Required Two (2) years of full‑time experience in software development, cloud engineering, SIEM engineering, or cybersecurity engineering
• Three (3) or more years of hands‑on technical experience with Microsoft Sentinel.
• Experience developing UEBA models, anomaly detection rules, and behaviour‑based analytics.
• Experience building Security Automation Playbooks (SOAR). Microsoft certifications such as: SC-200: Security Operations Analyst, AZ‑900 / AZ‑104, SC‑100 / SC‑300
• Experience integrating Sentinel with EDR, IAM, firewalls, and ticketing systems.
• Experience with DevOps pipelines (GitHub, Azure DevOps).
• Experience working in a government, healthcare, or regulatory environment

Seniority level

• Mid‑Senior level

Employment type

• Contract

Job function

• Information Technology

Industries

• Human Resources Services