[Hiring] Microsoft Security Engineer @Integrity360

Role Description

As a Microsoft Security Engineer, you will be responsible for onboarding clients to our managed security service, with Microsoft Sentinel at the centre of the solution. Your primary focus will be the technical delivery of new Microsoft Sentinel onboardings, which includes:

• Configuring and integrating Sentinel environments
• Onboarding and validating log sources
• Preparing each deployment for effective monitoring and operational handover to the Security Operations Centre

You will work closely with clients, architects, and SOC teams to ensure each deployment is supportable, secure, and aligned with the contracted service scope. The role also requires hands-on experience, or a clear ability to develop quickly, in onboarding Microsoft Defender XDR workloads.

This is a client-facing engineering role within Professional Services, reporting to the Head of Cloud Security & Microsoft Security Services. You will manage assigned onboarding activities from discovery and design through implementation, testing, documentation, and handover.

Key Responsibilities

• Deliver end-to-end onboarding of client Microsoft Sentinel environments into the MSSP service.
• Configure Sentinel workspaces, content solutions, data connectors, analytics rules, automation rules, watchlists, workbooks, and related components in accordance with approved designs and service standards.
• Run technical discovery sessions to identify log sources, connectivity requirements, data volumes, retention needs, dependencies, and onboarding priorities.
• Onboard Microsoft, third-party, cloud, network, identity, and application log sources using supported collection methods.
• Design and implement data filtering and transformation to improve signal quality and control ingestion costs.
• Validate data ingestion, parsing, field mapping, timestamps, health and coverage, and troubleshoot issues.
• Tune analytics rules, alert logic, and incident generation in collaboration with SOC and detection engineering teams.
• Onboard and integrate Microsoft Defender XDR workloads.
• Produce accurate high-level designs, implementation plans, configuration records, test evidence, operational runbooks, and handover documentation.
• Coordinate with clients, project managers, architects, SOC analysts, and service teams to manage dependencies, risks, actions, and readiness for service transition.
• Apply repeatable engineering standards, peer review, and change control.
• Support troubleshooting and remediation during onboarding and early-life support.
• Undertake occasional travel where required to support client delivery.

Qualifications

• Hands-on experience deploying, configuring, or supporting Microsoft Sentinel in production or customer environments.
• Practical knowledge of Sentinel data connectors, Log Analytics workspaces, Azure Monitor Agent, Data Collection Rules, syslog, and CEF collection patterns.
• Strong Kusto Query Language skills for data validation, troubleshooting, investigation, and detection tuning.
• Experience onboarding and troubleshooting log sources across Microsoft 365, Azure, endpoints, identity, network, security, and third-party platforms.
• Understanding of ingestion filtering, data transformation, parsing, normalization, retention, and the cost implications of security telemetry.
• Experience creating clear technical designs and delivery documentation.
• Working knowledge of Microsoft Defender XDR and the integration of its workloads with Microsoft Sentinel.
• Sound understanding of SIEM operations, detection engineering principles, incident workflows, and the requirements of a managed security service.
• Strong troubleshooting skills across Azure, APIs, identity, networking, and data collection components.
• Confident written and verbal communication skills, with the ability to work directly with technical and non-technical client stakeholders.
• Ability to manage assigned work independently while collaborating effectively with project, architecture, SOC, and service teams.

Requirements

• Experience working for an MSSP, MDR provider, Security Operations Centre, or security-focused professional services team.
• Development of custom log parsers, KQL functions, ASIM-compatible content, or other normalization patterns for non-standard data sources.
• Experience with DevOps pipelines and source control for Microsoft Sentinel content, configuration, and deployment.
• Practical knowledge of detection as code, including versioning, testing, peer review, and controlled promotion of analytics content.
• Experience with infrastructure as code and automation using technologies such as Bicep, ARM templates, Terraform, PowerShell, Azure CLI, Logic Apps, or APIs.
• Knowledge of Microsoft Sentinel repositories, content management, and repeatable multi-customer deployment patterns.
• Experience integrating Microsoft security services across tenants, subscriptions, or delegated administration models.
• Familiarity with MITRE ATT&CK and its application to detection coverage and use-case mapping.

Desired Qualifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500/SC-500).
• Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• Relevant Microsoft Applied Skills covering Sentinel, Defender XDR, security operations, or automation.
• Other relevant security or cloud certifications are beneficial but not essential.