SIEM Engineer

SIEM Content and Platform Engineer – Hybrid (London office 1 day per month) Full-time | Cyber Security | Hybrid, with one day a month in the London office

About the role If you like building detection systems that analysts trust and a SIEM platform that scales, this role is for you. You will join the Cyber Security team to improve the Proactive Security monitoring capability, working with Security Operations, Infrastructure, Cloud and Application teams. You will be the subject matter expert for Microsoft Sentinel and detection engineering, delivering reliable telemetry, high-fidelity detections and secure integrations across a large enterprise.

What you’ll be doing

• Design, test, deploy and tune analytics rules, correlation logic and hunting queries aligned with MITRE ATT&CK

• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations

• Set logging standards, onboarding patterns and governance for the detection engineering lifecycle

• Automate security workflows with Logic Apps, Azure Functions, REST APIs, PowerShell and Python

• Build Sentinel workbooks, platform health monitoring and KPI/KRI reporting for the Proactive Security function

• Lead platform enhancements, proofs of concept, migrations and upgrades, and support critical incidents and major changes

What we’re looking for

• Proven SIEM, detection or security platform engineering experience in a large enterprise (essential)

• Strong hands-on Microsoft Sentinel and Defender XDR experience across Endpoint, Identity and Cloud, including advanced KQL (essential)

• Experience onboarding infrastructure, cloud, application and security telemetry, with Azure Monitor Agent, Azure Arc and Log Analytics

• Experience with Detection-as-Code, including CI/CD, source control and peer review, plus Windows Event Forwarding, Sysmon and PowerShell logging

• Practical security engineering skills: platform hardening, vulnerability remediation, technical risk assessment and control validation

• Clear communication with technical and management stakeholders, calm delivery under pressure, and willingness to provide planned out-of-hours support for critical upgrades and major changes

• Desirable: SC-200 or AZ-500, plus Cribl experience

What you get

• Hands-on work with Azure technologies and cloud transformation projects

• Competitive compensation

• Career growth opportunities

• Access to continuous learning and certifications

• The chance to work on impactful cloud initiatives across various industries

• Hybrid working, with just one day a month in the London office

This role suits A detection or platform engineer who enjoys treating security monitoring as an engineering discipline, with version control, peer review and measurable quality.