Jobs → Engineering → Microsoft Sentinel Engineer / Architect

About the Role We are seeking a highly experienced Microsoft Sentinel Engineer / Architect to lead the design, implementation, optimization, and automation of enterprise security solutions. The ideal candidate will have deep hands-on expertise in Microsoft Sentinel, KQL, Azure security, SIEM/SOAR, detection engineering, threat hunting, and security automation. Key Responsibilities • Architect and optimize Microsoft Sentinel, including workspace design, data onboarding, analytics rules, and dashboards. • Develop advanced KQL queries for threat hunting, detection engineering, and incident investigations. • Build SOAR playbooks and automate security workflows using Azure Logic Apps and Azure Functions. • Engineer Azure security solutions using Microsoft Defender for Cloud, Entra ID, Conditional Access, Azure Policy, and Key Vault. • Implement Microsoft Purview security controls, including DLP, sensitivity labels, and insider risk management. • Integrate Microsoft and third-party security platforms using REST APIs, webhooks, and custom connectors. • Implement Infrastructure as Code and CI/CD practices for security content and automation. • Support incident response, threat analysis, vulnerability management, and security operations improvement. Requirements • 10+ years of overall experience in Cloud Security, Information Security, Security Architecture, or DevSecOps. • 5+ years of hands-on Microsoft Sentinel engineering and architecture experience. • Advanced proficiency in KQL, SIEM/SOAR, detection engineering, and threat hunting. • Strong Microsoft Azure security experience, including Defender for Cloud and Microsoft Entra ID. • Hands-on Microsoft Purview experience with DLP, information protection, and compliance controls. • Experience with Azure Logic Apps, Azure Functions, Python, and PowerShell. • Infrastructure as Code: Terraform, Bicep, or ARM templates. • Git, Azure DevOps/GitHub, CI/CD pipelines, and security automation. • Strong knowledge of network security, identity security, incident investigation, and advanced threat defense.