Cybersecurity Security Operations Engineer (Microsoft Sentinel/SIEM)

Skills: Microsoft Sentinel, SIEM, SOAR, EDR, XDR, NDR, KQL, SPL, Incident Response, Threat Hunting, Log Analysis, Detection Engineering, Threat Intelligence, Network Security, IDS/IPS, Firewalls, DNS, VPN, TCP/IP, HIPAA, NIST, CIS Controls, Splunk, Microsoft Defender, Security Monitoring.

Key Responsibilities

• Monitor, investigate, and respond to security incidents using Microsoft Sentinel .

• Perform log analysis, alert triage, threat hunting, and security monitoring across enterprise environments.

• Work with SIEM, SOAR, EDR, XDR, and NDR technologies to detect and investigate threats.

• Write and maintain KQL, SPL, and security queries for investigations and reporting.

• Analyze network traffic, endpoint alerts, and indicators of compromise.

• Document investigations, escalate critical incidents, and provide leadership-ready security reports.

• Support compliance with NIST, CIS Controls, HIPAA, and state security standards .

Required Qualifications

• 7+ years of experience in cybersecurity, network security, security operations, or incident response.

• Hands-on experience with Microsoft Sentinel (analytics rules, workbooks, automation, incident management, and data connectors).

• Strong experience with SIEM platforms , security log management, and threat intelligence.

• Experience with EDR, XDR, NDR , and detection engineering methodologies.

• Strong understanding of firewalls, IDS/IPS, DNS, VPN, TCP/IP, and secure network architecture.

• Excellent analytical, problem-solving, and communication skills.

Preferred Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field.

• Microsoft Security certifications (Security Operations Analyst, Azure Security Engineer, Cybersecurity Architect).

• Additional certifications such as CISSP, CISM, CISA, CompTIA Security+, CySA+, GIAC, Splunk, or SentinelOne are a plus.

Preferred Experience: Candidates with 10+ years of experience in SIEM architecture, detection engineering, threat intelligence, and security log management are highly preferred.