Description

Own the release, tuning, and optimization of the Microsoft Sentinel and Defender ecosystem to protect infrastructure and data.

Manage and integrate log sources into Microsoft Sentinel, developing custom use cases for threat detection. Tune detection logic and build workbooks to improve response efficiency. Develop Logic Apps and Function Apps for security orchestration and automation. Support incident response activities to contain, remediate, and recover from security events. Create and maintain technical documentation for security event processing.

Responsibilities

• Lead log onboarding and integration for Microsoft Sentinel, including custom use case development.
• Improve threat detection and response efficiency through use case tuning, automation, and workbook development.
• Develop Logic Apps and Function Apps to support security orchestration and automation.
• Assist in incident response processes to contain, remediate, and recover from security incidents.
• Create and maintain technical documentation for security event processing.

Required Skills

• 5+ years of IT experience with at least 3 years hands-on with Microsoft Sentinel and Microsoft Defender.
• Proficiency in Kusto Query Language (KQL) for developing use cases and advanced queries.
• Experience with Function App and/or Logic App development.
• Strong foundation in cloud technologies and services.
• Ability to create, manage, and investigate security alerts, anomalies, and breach patterns.
• Experience configuring and monitoring SIEM platforms and integrating with MSSP services.
• Competency in scripting with PowerShell and Python.

Preferred Skills

• Professional certifications such as SC-100, Security+, CISSP, or CCSP.
• Knowledge of the Financial Services or Wealth Management domains.

Key Skills

Education

ANY GRADUATE