SIEM Detection Engineer (Microsoft Sentinel)

Overview

Closr Talent is recruiting for a confidential UK-based managed services provider seeking a SIEM Detection Engineer to join its Cyber Operations Engineering team. The role focuses on Microsoft Sentinel engineering, detection tuning, SIEM ingestion reliability and supporting customer-facing security monitoring services.

Responsibilities

• End-to-end Microsoft Sentinel engineering, including customer onboarding, data connectors, integrations, KQL, automation, dashboards and reporting
• Detection tuning, enrichment and optimisation across Microsoft Sentinel
• Maintain and troubleshoot SIEM ingestion pipelines, including connectors, parsing, content, automation and transformation logic
• Monitor SIEM latency, throughput and data fidelity to help prevent data loss
• Investigate and resolve technical issues affecting SIEM data and detection capabilities
• Work with customers and internal stakeholders to identify improvement opportunities
• Contribute to the development and improvement of cyber security practices and capabilities
• Translate technical requirements, standards, runbooks and feed specifications for non-technical stakeholders

Essential requirements

• Practical experience with SIEM engineering, preferably Microsoft Sentinel
• Experience with KQL and SIEM data investigation or detection development
• Understanding of security and compliance frameworks such as NIST CSF, SOC 2 or equivalent
• Understanding of security architecture and IT security policies relevant to logging
• Understanding of secure data transport, retention and privacy considerations
• Experience troubleshooting SIEM data ingestion and integration issues
• Strong written and verbal communication skills
• Ability to explain technical information to non-technical audiences
• Customer-focused approach with proactive problem-solving skills
• Experience working in an MSP, MSSP or similar customer-facing security environment is strongly preferred

Desirable requirements

• Experience with other SIEM platforms such as AlienVault or Elastic
• Experience with EDR/MDR technologies
• Experience with vulnerability management platforms
• Experience working across multiple customer environments
• Experience with SIEM automation and transformation workflows
• Relevant Microsoft Sentinel or Azure security experience

Technical skills

Certifications

Benefits

• Hybrid working — 2 days in the office and 3 days from home
• Flexible working hours
• Flexibility around school pick-up and drop-off
• Opportunity to work on customer-facing SIEM and security monitoring environments
• Supportive team environment that encourages applications from candidates who do not meet every requirement

Our recruitment process

1. Initial screening call with your dedicated recruiter
2. CV and profile shared with the hiring team (with your consent)
3. Client interview(s)
4. Offer and onboarding support