Principal - Architecture
Summary
Senior security architecture role (15+ years' experience) designing and implementing Azure/O365 E5 security, Microsoft Sentinel and Azure Log Analytics. Day to day: building SIEM/SOAR use cases, KQL queries, log connectors, playbooks, workbooks and incident-response automation, based in Hyderabad, Pune or Bengaluru.
Job description
Must have deep expertise in Security Architecture design and implementation on cloud Azure O365 E5 Security and good to have on AWS GCP. Total experience 15 years.
Additionally, there is a requirement of at least min 10 years of experience in Microsoft Sentinel, Azure log analytics, and the development of Kusto Query Language.
Experience in the implementation of SIEM and SOAR is also necessary.
Familiarity with automation scripting is expected.
Primary focus will be on the creation and development of SIEM and SOAR use cases. The role requires real-time experience in data collection utilizing the Sentinel and Azure Log Analytics toolsets.
The candidate should have experience in connecting various log connectors using the built-in log collector and should be adept at connecting on-premises security logs from various sources where Sentinel lacks ready-made connectors. Knowledge of different methods for collecting security event logs, such as syslog, rsyslog, and syslog-ng, is essential, along with hands-on experience in implementing these functions.
The Engineer should also have experience in developing playbooks, analytic rules, workbooks, notebooks, incident response, threat hunting, and crafting KQL queries for data normalization and parsing capabilities within the Log
Analytics data ingestion pipeline. Required Technical Skills include: - High proficiency in Microsoft Sentinel and Azure Log Analytics. - Capability to connect any type of logs from any source to the Sentinel Log Analytics workspace. - Hands-on experience in creating playbooks, analytic rules, workbooks, notebooks, and incident response for threat hunting. - Experience in developing KQL queries for data normalization and parsing capabilities for the Log Analytics data ingestion pipeline. - Ability to automate and integrate developed use cases into the DevOps CI/CD pipeline. - Development and automation of incident response capabilities using Azure Logic Apps. - Development of Jupyter notebooks using any scripting language, such as Python, to integrate with Microsoft Sentinel.
Additional Skills: Azure Network Security (DDoS, Azure WAF, Azure Firewall) Experience in Sentinel Multi-Tenant Deployment Knowledge of configuring Sentinel third-party connectors Strong understanding of MS Purview DLP (Data Security, Data Governance, Data Compliance).
Educational Qualification:
BCAMCABEBTech or equivalent
Skills
Mandatory Skills :
Microsoft Defender, MS Sentinel, Azure Security Products