SIEM Engineer (Microsoft Sentinel)

We are seeking a hands-on SIEM & Security Operations Engineer with strong experience in Microsoft Sentinel to work as a dedicated outsourced resource within a customer's cybersecurity environment.

The selected candidate will be responsible for the day-to-day administration, monitoring, maintenance, troubleshooting, and continuous improvement of the customer's existing Microsoft Sentinel SIEM platform.

The role requires practical technical experience in SIEM operations, security event analysis, incident investigation, log source integrations, and security monitoring.

Additional experience in firewalls, endpoint security, vulnerability management, and other cybersecurity technologies will be considered an advantage.

Key Responsibilities

1. Microsoft Sentinel Administration & Operations

• Administer, manage, and maintain the existing Microsoft Sentinel environment.
• Monitor SIEM platform health, performance, log ingestion, and data availability.
• Configure, maintain, and troubleshoot security data connectors and log sources.
• Manage analytics rules, detection use cases, workbooks, dashboards, and watchlists.
• Develop and optimize Kusto Query Language (KQL) queries.
• Fine-tune detection rules and reduce false-positive alerts.
• Monitor data ingestion, retention, and SIEM-related operational costs.
• Support configuration changes, platform enhancements, and operational improvements.

1. Security Monitoring & Incident Management

• Monitor and investigate security alerts and incidents generated by Microsoft Sentinel.
• Analyze security events from endpoints, servers, network devices, firewalls, and cloud services.
• Perform initial incident triage, investigation, and escalation.
• Identify suspicious activities, security threats, and potential compromises.
• Support incident response, containment, and remediation activities in coordination with the customer's security team.
• Conduct basic threat hunting and security event correlation.
• Maintain incident records and prepare operational and security reports.

1. SIEM Integration & Technical Troubleshooting

• Maintain existing integrations between Microsoft Sentinel and other security technologies.
• Troubleshoot log collection, connectivity, parsing, and data ingestion issues.
• Support the onboarding of additional log sources when required.
• Work with Windows/Linux logs, Syslog, CEF, Azure logs, and Microsoft 365 security events.
• Coordinate with internal IT, network, infrastructure, and security teams to resolve technical issues.

1. Security Operations & Continuous Improvement

• Review and improve existing security detection rules and monitoring use cases.
• Assist with security monitoring improvements based on emerging threats.
• Support security automation and incident response workflows using Sentinel Playbooks and Azure Logic Apps.
• Perform regular SIEM health checks and configuration reviews.
• Maintain technical documentation, operational procedures, and incident response records.
• Prepare daily, weekly, and monthly security operations reports as required.

Required Qualifications & Skills

• Minimum 3–4 years of hands-on experience in cybersecurity, SIEM administration, or security operations.
• Practical experience administering and managing Microsoft Sentinel in a production environment.
• Strong understanding of SIEM operations, log management, event correlation, and security monitoring.
• Experience with KQL queries, analytics rules, and incident investigation.
• Ability to troubleshoot log ingestion, data connectors, and SIEM configuration issues.
• Knowledge of Microsoft Azure, Microsoft 365 security logs, and Microsoft Defender integrations.
• Good understanding of networking fundamentals, security threats, and incident response.
• Ability to independently handle day-to-day SIEM operational activities.
• Good documentation, reporting, and communication skills.

Additional Cybersecurity Skills – Advantage

Experience in any of the following areas will be considered an added advantage, but is not mandatory:

• Network Security & Firewalls: Fortinet FortiGate, Palo Alto Networks, Check Point, or similar firewall solutions.
• Endpoint Security: Microsoft Defender for Endpoint, CrowdStrike, or other EDR/XDR solutions.
• Vulnerability Management: Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Management.
• Cloud Security: Microsoft Defender for Cloud and Azure security monitoring.
• Identity Security: Microsoft Entra ID, MFA, Conditional Access, and identity security monitoring.
• Security Automation: PowerShell, Python, Azure Logic Apps, and SOAR workflows.
• Other SIEM Technologies: Splunk, IBM QRadar, LogRhythm, or similar platforms.
• Security Assessments: Vulnerability scanning, security configuration reviews, and basic security hardening.

Preferred Certifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Azure Security-related certifications.
• CompTIA Security+.
• Fortinet, Palo Alto Networks, or other relevant cybersecurity certifications.

Candidate Profile

The ideal candidate is a practical, hands-on cybersecurity engineer who can independently manage the daily operations of an existing Microsoft Sentinel environment, investigate security incidents, maintain integrations, and support ongoing security improvements.

Candidates with additional operational experience in firewalls, endpoint security, vulnerability management, or other cybersecurity technologies will be highly preferred.

Pay: AED6,000.00 - AED12,000.00 per month

Experience:

• Microsoft Sentinel: 2 years (Required)

Work Location: In person