SIEM Engineer

Job Description

The client is seeking a skilled SIEM Engineer to architect and build a greenfield Microsoft Sentinel environment from the ground up, integrating multi-source log feeds across on-premises, cloud, and network infrastructure.

Minimum Requirements

• 6 years of progressive enterprise security operations experience, with at least 3 years of dedicated, hands-on Microsoft Sentinel engineering and deployment.
• Deep understanding of log ingestion methodology, multi-source log feeds (on-premises, cloud, firewalls), and data orchestration principles, not just tooling.
• Proficiency with Azure Monitor, Log Analytics Workspaces, DCR/AMA architecture, and cold/warm/hot storage tiers including data lake integration.
• Strong proficiency in Azure Logic Apps and Azure Function Apps, with scripting ability in PowerShell or Python.
• Experience deploying Azure security resources using Infrastructure as Code tools such as ARM templates, Bicep, or Terraform.
• Demonstrated ability to interface cross-functionally with multiple teams to gather and onboard log sources, with strong project management and organizational skills.
• Advanced KQL proficiency for detection engineering, parsing, and threat hunting.
• Experience with additional SIEM platforms beyond Microsoft Sentinel, with the ability to apply transferable methodology.
• Familiarity with AI/ML tools applied to threat hunting, root-cause analysis, or automated incident response.
• Experience developing and presenting security metrics (MTTD, MTTR) to leadership.
• Relevant certifications such as GCIH, GCFA, GNFA, CISSP, SC-200, or SC-100.

Benefits

Eligible for Health, Dental, Vision, and 401K