Microsoft Sentinel Onboarding Engineer (MSSP)

Integrity360; Johannesburg; Presencial; ZAR 600 000 - 900 000; Tempo integral

Resumo da oferta

Integrity360 is seeking a Microsoft Security Engineer to onboard clients to our MSSP service, centric to Microsoft Sentinel deployments. You will configure workspaces, connectors and analytics rules, and collaborate with clients, architects and SOC teams to ensure secure, supported deployments.

The role requires hands-on experience with Sentinel, Defender XDR workloads, and a strong focus on delivering high-quality designs, runbooks and handover materials.

Qualificações

• Hands-on experience deploying, configuring or supporting Microsoft Sentinel in production or customer environments.
• Knowledge of Sentinel data connectors, Log Analytics workspaces, Azure Monitor Agent, Data Collection Rules, syslog and CEF collection patterns.
• Strong Kusto Query Language skills for data validation, troubleshooting, investigation and detection tuning.
• Experience onboarding and troubleshooting log sources across Microsoft 365, Azure, endpoints, identity, network, security and third-party platforms.
• Understanding of ingestion filtering, data transformation, parsing, normalisation, retention and the cost implications of security telemetry.
• Experience creating clear technical designs and delivery documentation, including HLDs, implementation plans, test records and operational handover materials.
• Working knowledge of Microsoft Defender XDR and the integration of its workloads with Microsoft Sentinel.
• Sound understanding of SIEM operations, detection engineering principles, incident workflows and the requirements of a managed security service.
• Strong troubleshooting skills across Azure, APIs, identity, networking and data collection components.
• Confident written and verbal communication skills, with the ability to work directly with technical and non-technical client stakeholders.
• Ability to manage assigned work independently while collaborating effectively with project, architecture, SOC and service teams.

Responsabilidades

• Deliver end-to-end onboarding of client Microsoft Sentinel environments into the MSSP service.
• Configure Sentinel workspaces, content solutions, data connectors, analytics rules, automation rules, watchlists, workbooks and related components in accordance with approved designs and service standards.
• Run technical discovery sessions to identify log sources, connectivity requirements, data volumes, retention needs, dependencies and onboarding priorities.
• Onboard Microsoft, third-party, cloud, network, identity and application log sources using supported collection methods, including Azure Monitor Agent, Data Collection Rules, APIs, syslog, CEF and custom connectors where appropriate.
• Design and implement data filtering and transformation to improve signal quality, control ingestion costs and ensure the service receives the telemetry required for monitoring and detection.
• Validate data ingestion, parsing, field mapping, timestamps, health and coverage, and troubleshoot issues across source systems, collectors, networks and Azure services.
• Tune analytics rules, alert logic and incident generation in collaboration with SOC and detection engineering teams to reduce unnecessary noise while maintaining appropriate coverage.
• Onboard and integrate Microsoft Defender XDR workloads, including Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud Apps.
• Produce accurate high-level designs, implementation plans, configuration records, test evidence, operational runbooks and handover documentation.
• Coordinate with clients, project managers, architects, SOC analysts and service teams to manage dependencies, risks, actions and readiness for service transition.
• Apply repeatable engineering standards, peer review and change control, and contribute improvements to onboarding templates, technical patterns and internal procedures.
• Support troubleshooting and remediation during onboarding and early-life support, escalating product or service dependencies where required.
• Undertake occasional travel where required to support client delivery.

Conhecimentos

Microsoft Sentinel

KQL

Azure Monitor

Data collection rules

Log Analytics

SIEM operations

Onboarding & deployment

Communication skills

Security engineering

DevOps pipelines

Microsoft Defender XDR

Azure API / REST

Ferramentas

Azure Monitor Agent

Data Collection Rules

Syslog

CEF

DevOps pipelines

Version control

Bicep / ARM templates

Terraform

PowerShell

Azure CLI

Descrição da oferta de emprego

Integrity360 is seeking a Microsoft Security Engineer to onboard clients to our MSSP service, centric to Microsoft Sentinel deployments. You will configure workspaces, connectors and analytics rules, and collaborate with clients, architects and SOC teams to ensure secure, supported deployments.

The role requires hands-on experience with Sentinel, Defender XDR workloads, and a strong focus on delivering high-quality designs, runbooks and handover materials.