An exciting opportunity has arisen at an award-winning Microsoft Partner for a SIEM Engineer. The business is a fast-growing, industry-leading managed service and managed service security provider, delivering in to mid and large enterprise clients.

This is a fantastic opportunity for a SIEM Engineer to continue their development of security platofrms at an established Microsoft Partner. The business has a keen focus on developing their staff by providing support for training and earning certifications. You will also gain exposure to cutting-edge technologies, working across security operations and cyberspace.

This is a predominantly remote role; you must however be based in the UK to be considered. This role will also require eligibility to gain SC Clearance due to government-based customers.

• Create, maintain, and optimize Logic Apps and Sentinel playbooks to automate incident detection and response workflows in Microsoft Sentinel.
• Develop and implement API integrations between Microsoft Sentinel and other systems to enhance data collection, cross-system communication, and automation.
• Leverage APIs to streamline security operations and increase the SOC’s efficiency.
• Design and deploy automated workflows to handle routine SOC tasks, including alert enrichment, notifications, and data gathering.
• Work closely with security analysts and engineers to design automation solutions to improve overall security posture.
• Monitor and maintain automation tools to ensure they are functioning as expected, identifying opportunities for further improvements.

• Hands-on experience with Microsoft Sentinel: Proven track record in developing playbooks, automation workflows, and incident response processes within Microsoft Sentinel.
• Experience in building and maintaining workflows with Azure Logic Apps to automate processes.
• Strong experience in API development and integration.
• Proficiency in KQL, JSON and PowerShell.
• Good written and verbal communication skills.
• Technical understanding of IT infrastructure – Microsoft 365 suite, Defender XDR, Entra ID (Azure Active Directory), Azure portal.