This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
We are looking for a skilled Microsoft Sentinel Engineer to design, build, and operationalize a Microsoft Sentinel Security Information and Event Management (SIEM) and SOAR solution from the ground up. This contract role is critical for establishing a modern, centralized security operations platform that ingests data from multiple sources, detects threats using advanced analytics, automates response through playbooks, and delivers actionable insights to leadership. The successful candidate will serve as the lead architect and implementer, responsible for configuring data connectors, developing custom KQL analytics rules, building automation workflows, and integrating Sentinel with existing tools and processes.
Job Responsibility:
Architect and deploy Microsoft Sentinel from scratch in a greenfield environment
Configure and optimize data connectors for the following sources: Fortinet Firewall, Nutanix, Windows Servers & Endpoints, Microsoft 365 E5 Security, Veeam Backup
Develop custom KQL (Kusto Query Language) analytics rules for threat detection, anomaly detection, and hunting
Design and implement SOAR playbooks using Azure Logic Apps for automated investigation and response
Enable and tune User and Entity Behavior Analytics (UEBA)
Create executive-level workbooks and dashboards for leadership visibility and reporting
Integrate Microsoft Sentinel with the existing ticketing system for automated incident creation and orchestration
Establish ingestion cost controls, data retention policies, and optimization strategies
Develop runbooks, operational procedures, and knowledge transfer materials for the internal SOC team
Provide expert guidance on Sentinel best practices, scaling, and roadmap
Requirements:
SC-200: Microsoft Security Operations Analyst (must be current)
AZ-500: Microsoft Azure Security Technologies (must be current)
6+ years of hands-on experience with Microsoft Sentinel and Azure security technologies
Strong demonstrated expertise in writing and optimizing KQL (Kusto Query Language) queries and analytics rules
Proven experience deploying Sentinel in production environments, including data connector configuration, custom rule development, SOAR playbooks, UEBA, and integrations
Deep knowledge of Azure Logic Apps for automation and orchestration
Experience integrating Sentinel with third-party firewalls, backup solutions, hypervisors, and Microsoft 365 security tools
Solid understanding of security operations workflows, incident response processes, and SIEM/SOAR best practices
Nice to have:
Experience in healthcare or regulated industries
Familiarity with Microsoft Defender suite and Entra ID integration with Sentinel
Prior work with MITRE ATT&CK framework mapping in analytics rules
Experience with Azure Data Explorer, Log Analytics workspaces, and cost management
Additional certifications such as SC-400 or MS-500