SIEM Engineer

Summary: The SIEM Engineer role involves supporting the integration of log sources into Microsoft Sentinel, developing custom data parsers, and optimizing KQL queries for threat detection. The position requires SC clearance and focuses on automating response workflows and improving detection fidelity. This is a hybrid role based in Reading, with a day rate of up to £700. The contract duration is six months.

Key Responsibilities:

• Lead onboarding and integration of log sources into Microsoft Sentinel.
• Develop custom parsers and data transformations to normalize and enrich ingested data.
• Design and optimize KQL queries for effective threat detection and investigation.
• Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases.
• Develop Logic Apps and SOAR workflows to automate response and reduce manual effort.
• Implement CI/CD pipelines (Azure DevOps/Git) for controlled deployment of SIEM content.
• Automate deployment and configuration across environments to improve consistency and speed of delivery.
• Perform ongoing tuning and optimization of detections to improve fidelity and reduce false positives.

Key Skills:

• SC Clearance.
• Experience with Microsoft Sentinel.
• Proficiency in KQL (Kusto Query Language).
• Knowledge of developing custom parsers and data transformations.
• Experience with Logic Apps and SOAR workflows.
• Familiarity with CI/CD pipelines, particularly Azure DevOps/Git.
• Ability to automate deployment and configuration processes.
• Strong analytical skills for tuning and optimizing detections.

Salary (Rate): £700 per day

City: Reading

Country: United Kingdom

Working Arrangements: hybrid

IR35 Status: inside IR35

Seniority Level: undetermined

Industry: IT