Microsoft Sentinel Engineer - Security Operations

MS Sentinel Engineer

Experience: 5 - 8 yrs

Location: Chennai/Bangalore/Hyderabad/Coimbatore

Key Responsibilities:

- Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment, including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks.

- Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial triage, investigate suspicious activities, and support incident response and escalation.

- Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and detection use cases to reduce false positives and improve threat detection.

- Integration with Managed SecOps: Support onboarding and integration of the client's Sentinel environment with the Managed SecOps processes, tools, workflows, and escalation procedures.

- Data Connector Management: Validate existing integrations and configure or troubleshoot connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other supported security data sources.

- KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat hunting, investigations, detection engineering, and operational reporting.

- Transition & Knowledge Transfer: Review existing Sentinel configurations, document current operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent provider wherever access and cooperation are available.

- Operational Readiness: Help establish incident handling workflows, escalation matrices, reporting processes, and runbooks for the future co-managed service.

- Documentation & Reporting: Maintain technical documentation, incident investigation notes, configuration records, and transition status reports.

- Continuous Improvement: Identify gaps in logging, detection coverage, automation, and platform configuration, and recommend remediation actions.

Required Technical Skills:

- Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions.

- Proficiency in KQL for security investigations, threat hunting, and analytics rule development.

- Experience configuring and troubleshooting Sentinel data connectors and log ingestion.

- Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft 365 security telemetry.

- Experience with SIEM operations, security incident investigation, alert triage, and escalation.

- Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat hunting.

- Experience with Sentinel automation rules, playbooks, and Logic Apps.

- Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control.

- Strong troubleshooting, documentation, communication, and stakeholder management skills.

Preferred Qualifications:

- Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience.

- Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps environment.

- Experience with SIEM transitions, security platform onboarding, and co-managed SOC operating models.

- Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code practices.

Expected Deliverables:

- 1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage.

- 2. Maintain continuity of Sentinel platform support and agreed security monitoring activities.

- 3. Identify and address critical gaps in data ingestion, detection rules, and incident handling.

- 4. Integrate the client environment into the Managed SecOps workflows and escalation processes.

- 5. Document the existing configuration, operational procedures, and outstanding risks.

- 6. Support service transition, knowledge transfer, and readiness for the future co-managed Sentinel model.