Senior Microsoft Security Engineer

Senior Microsoft Security Engineer


Sentinel & Defender XDR


Duration : 6 + months


Location : Remote

About the Role


Senior Microsoft Security Engineer who knows Sentinel inside and out - and can carry that expertise across into Defender XDR. This is not a generalist role. The ideal candidate has deep, hands-on Sentinel experience, understands how Defender XDR maps to it functionally, and has ideally led or been a key contributor to a Sentinel-to-XDR migration in a production environment.


You will be embedded with a client SOC team, owning detection engineering, platform configuration, and the technical work required to bridge two platforms without dropping coverage or continuity. If you have lived through a migration and know where the gaps are, this role was written for you.


Key Responsibilities


Microsoft Sentinel (Primary Platform)

• Design, configure, and optimize Microsoft Sentinel environments including data connectors, analytics rules, and workbooks
• Build and maintain detection logic using UEBA, ML-based anomaly detection, and threat intelligence integrations
• Develop KQL queries and hunting workbooks for proactive threat identification
• Create and manage SOAR playbooks via Azure Logic Apps to automate SOC response workflows
• Continuously tune detection rules and reduce false positive rates in partnership with the SOC team
• Document architecture decisions, runbooks, and operational procedures

Microsoft Defender XDR (Secondary Platform)

• Map existing Sentinel analytics rules, KQL logic, and detection coverage to Defender XDR equivalents
• Configure and manage Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps within a unified XDR framework
• Define and implement custom detection rules, incidents, and automated response actions within Defender XDR
• Assess capability gaps between the two platforms and develop mitigation or transition plans
• Leverage AI-native Defender XDR capabilities including automatic attack disruption and AI-assisted investigation

Migration & Cross-Platform Work

• Lead or support Sentinel-to-XDR migration workstreams including data migration, rule translation, and platform configuration
• Identify functional equivalencies and gaps between platforms and communicate tradeoffs clearly to SOC leadership
• Integrate both platforms with SIEM, SOAR, and CTI tooling as needed
• Support Copilot for Security and AI-powered SOC automation use cases across both platforms

Required Qualifications

• 5+ years of hands-on experience with Microsoft Sentinel in an enterprise SOC environment - this is non-negotiable
• Strong proficiency in KQL and the ability to translate detection logic across platforms
• Hands-on experience or equivalent training with Microsoft Defender for XDR, including deep familiarity with its sub-components: Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps (Note: Microsoft Defender XDR was released March 2026 - equivalent platform knowledge and migration readiness will be considered in place of tenure)
• Demonstrated experience with or direct involvement in a Sentinel-to-Defender XDR migration, or the ability to map Sentinel functionality to Defender XDR equivalents based on deep platform knowledge of both
• Solid understanding of XDR concepts, cross-domain correlation, and automated incident response
• Deep familiarity with the MITRE ATT&CK framework and its application to detection engineering
• Experience with Azure Logic Apps, Power Automate, or similar automation platforms
• Background in threat hunting, incident response, and SOC operations

Preferred Qualifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200) - strongly preferred
• Microsoft Certified: Cybersecurity Architect Expert (SC-100) - a plus
• Both certifications held simultaneously - this will stand out
• Hands-on experience with Copilot for Security and AI-assisted investigation features in Defender XDR
• Prior involvement in large-scale SIEM or XDR platform migrations
• Background in CTI integration and tooling
• Experience supporting global SOC teams across multiple regions
• Familiarity with SOAR platforms, CRIBL, or similar tools in the SOC ecosystem
• Exposure to digital forensics or agentic AI workflows in a security operations context