SIEM Engineer (Microsoft Sentinel)

Role overview

Microsoft Sentinel operations

• Administer and maintain Microsoft Sentinel; monitor platform health, performance, log ingestion, and data availability.
• Configure, maintain, and troubleshoot security data connectors and log sources.
• Manage analytics rules, detection use cases, workbooks, dashboards, and watchlists.
• Develop and optimize KQL queries, fine-tune detections, and reduce false-positive alerts.
• Monitor data ingestion, retention, and SIEM operational costs; support configuration changes and improvements.

Monitoring and incident management

• Monitor and investigate Sentinel alerts and events from endpoints, servers, network devices, firewalls, and cloud services.
• Perform initial incident triage and investigation; identify suspicious activity, threats, and potential compromises.
• Support incident response, containment, and remediation with the customer's security team.
• Conduct basic threat hunting and event correlation; maintain incident records and prepare operational and security reports.

Integration and continuous improvement

• Maintain Sentinel integrations with other security technologies and troubleshoot log collection, connectivity, parsing, and ingestion issues.
• Support onboarding additional log sources and work with Windows/Linux logs, Syslog, CEF, Azure logs, and Microsoft 365 security events.
• Coordinate with IT, network, infrastructure, and security teams to resolve technical issues.
• Improve detections and monitoring use cases, support Sentinel Playbooks and Azure Logic Apps workflows, and perform health checks and configuration reviews.
• Maintain technical documentation, operational procedures, incident records, and daily, weekly, or monthly reports as needed.

Required qualifications

• At least 3–4 years of hands-on cybersecurity, SIEM administration, or security operations experience.
• Production experience administering and managing Microsoft Sentinel.
• Strong understanding of SIEM operations, log management, event correlation, and security monitoring.
• Experience with KQL, analytics rules, and incident investigation.
• Ability to troubleshoot log ingestion, data connectors, and SIEM configuration issues.
• Knowledge of Microsoft Azure, Microsoft 365 security logs, and Microsoft Defender integrations.
• Good understanding of networking fundamentals, security threats, and incident response.
• Ability to independently handle daily SIEM operations; good documentation, reporting, and communication skills.
• Microsoft Sentinel experience is also listed as at least 2 years and required.

Additional advantageous skills

• Firewalls such as Fortinet FortiGate, Palo Alto Networks, or Check Point; endpoint tools such as Microsoft Defender for Endpoint or CrowdStrike.
• Vulnerability management tools such as Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Management; Microsoft Defender for Cloud and Azure security monitoring.
• Microsoft Entra ID, MFA, Conditional Access, identity monitoring, PowerShell, Python, Azure Logic Apps, SOAR, Splunk, IBM QRadar, or LogRhythm.
• Vulnerability scanning, security configuration reviews, and basic security hardening.
• These additional technologies and areas are advantageous, not mandatory.

Preferred certifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200), Microsoft Azure Security certifications, CompTIA Security+, or relevant Fortinet, Palo Alto Networks, or other cybersecurity certifications are preferred.

Pay

• Pay is AED 6,000–12,000 per month.

Work location

• Work location is in person.