Security Operations Engineer

Role overview

Detection engineering

• Design, write, and tune Microsoft Sentinel analytics rules and correlation logic aligned to MITRE ATT&CK.
• Identify and close visibility blind spots across infrastructure and telemetry as new log sources come online.
• Continuously validate and refine detections to reduce false positives without losing real signal.

Automation and response

• Build SOAR playbooks and workflows to automate triage, enrichment, and response.
• Build and maintain integrations across Sentinel, Defender, and other security tools using APIs and scripting.

Threat context and outcomes

• Translate emerging threats and adversary tactics, techniques, and procedures into actionable, tuned detection logic.
• Improve detection coverage for new log sources, reduce false positives, and shrink manual triage time so analysts can focus on investigations.

Required experience and skills

• At least 4 years in security operations, detection engineering, or a closely related technical security role.
• Hands-on experience building or substantially tuning detection rules and correlation logic in a SIEM; Sentinel is strongly preferred.
• Experience building SOAR playbooks or comparable security automation workflows.
• Ability to write and debug complex KQL or an equivalent SIEM query language independently.
• Python or PowerShell automation proficiency and experience integrating tools through REST APIs.
• Able to own and ship technical work independently.

Preferred experience

• Experience in an Azure/AKS or other Kubernetes-based cloud environment is a plus.
• Experience supporting SOC 2 or similar compliance audits from a technical evidence standpoint is a plus.
• Familiarity with Sentinel Logic Apps or another SOAR automation platform is a plus.

About Mastery