Cyber Security Engineer

Location: London (2 days onsite per week)

Day Rate: Competitive, dependent on experience

Duration: Initial contract with long-term extension potential

Start: ASAP

The Opportunity

We're partnering with a leading Microsoft Security Partner delivering a major cyber security transformation programme for a large enterprise organisation within the financial services sector.

We're looking for an experienced SIEM Content & Platform Engineer with deep Microsoft Sentinel expertise to help engineer, enhance and optimise enterprise security monitoring and detection capabilities.

This is a highly technical, hands-on engineering position requiring someone who can take ownership of both the Microsoft Sentinel platform and the detection content running within it.

This is not a traditional SOC Analyst role. We're specifically looking for engineers with proven experience building, configuring and optimising Microsoft Sentinel environments, developing sophisticated KQL detections and implementing security automation.

Key Responsibilities

• Engineer, configure and optimise Microsoft Sentinel across a complex enterprise environment.
• Develop, test and maintain advanced KQL queries, analytics rules, custom detections and correlation logic.
• Design and manage security telemetry ingestion using Azure Monitor Agent (AMA), Data Collection Rules (DCRs), Log Analytics and custom connectors.
• Integrate Microsoft Sentinel with Defender XDR, Entra ID, cloud workloads, endpoint security solutions and infrastructure logging sources.
• Develop and maintain automated security workflows using Azure Logic Apps, Azure Functions, PowerShell, Python and REST APIs.
• Improve detection quality, reduce false positives and enhance threat coverage using MITRE ATT&CK.
• Troubleshoot ingestion pipelines, platform performance and SIEM integration issues.
• Optimise ingestion costs, retention policies, log filtering and overall platform efficiency.
• Support continuous improvement of enterprise detection engineering capabilities.

Applicants must demonstrate hands-on commercial experience in the following areas:

• Microsoft Sentinel Engineering: Proven experience implementing, configuring, administering and optimising Sentinel environments, beyond day-to-day SOC monitoring.
• Advanced KQL: Strong ability to independently develop complex KQL queries, analytics rules and threat detection content.
• Detection Engineering: Experience designing, testing, tuning and maintaining custom SIEM detection rules and use cases.
• Data Ingestion: Practical experience with Azure Monitor Agent, Data Collection Rules, Log Analytics, data connectors or custom ingestion pipelines.
• Microsoft Security Integrations: Hands-on experience integrating security telemetry from Defender XDR and other enterprise security technologies.
• Security Automation: Experience developing or implementing automation using Logic Apps, PowerShell, Python, Azure Functions or APIs.
• Enterprise Security: Experience delivering security engineering solutions within complex enterprise environments.
• Detection-as-Code and CI/CD pipelines.
• Git, Azure DevOps or GitHub.
• Custom KQL parsers and advanced telemetry transformation.
• MITRE ATT&CK-based detection coverage.
• Financial services or other regulated environments.

Location: London, 2 days onsite per week

Start Date: ASAP

Contract Scope: Long-term programme with extension potential