DTICI_MS Sentinel Specialist (SIEM Engineer)_T8_Senior Consultant

Key Tasks & Responsibilities: 

• Configure and operate Microsoft Sentinel and Microsoft Defender for continuous security monitoring and alert investigation.

• Creation of Sentinel Playbooks & dashboards for platform monitoring.

• Ingesting of various types of Syslog data, Network devices via Api's etc. along with proper parsing of incoming data.

• Hands‑on experience working with Azure and AWS cloud environments, supporting security monitoring and investigation activities.

• Develop and maintain basic to intermediate dashboards and workbooks in Sentinel using KQL, Azure Monitor Logs, and security metrics.

• Perform alert tuning activities to improve detection accuracy and reduce false positives, under guidance from senior engineers.

• Support documentation activities including security procedures, operational guidelines, and runbooks for SOC use.

• Participate in incident investigations and provide analysis support as part of CSOC processes.

Key Skills:

• Strong working knowledge of Microsoft Sentinel, Microsoft Defender, and related Microsoft security tools. 

• Assist with administration and operational support of Azure, AWS, and hybrid environments from a security perspective.

• Good understanding of Azure architecture concepts, including compute, networking, storage, and Microsoft Entra ID. 

• Exposure to ingesting and parsing log sources such as Syslog, network devices, and cloud services. 

• Familiarity with custom connectors, scripts, or integrations for onboarding security data sources. 

• Understanding of SOC operations, alert lifecycle, and investigation workflows. 

• Experience working with SOC runbooks and operational documentation. 

• Basic exposure to other SIEM platforms such as Splunk, QRadar, or ArcSight is an advantage. 

• Good communication and collaboration skills, with the ability to work effectively with SOC teams, IT, and security stakeholders.

• Bachelor’s degree in computer science, Information Technology, Cyber Security, or a related field.

• Minimum of 4 to 7 years of experience in cyber security, with a focus on SIEM technologies

• Certifications:

  • SC‑200: Microsoft Security Operations Analyst

  • SC‑300 / SC‑100 (foundational exposure)

  • CISSP / CISM (foundational knowledge or pursuing)