Microsoft Sentinel Engineer - Security Operations

MS Sentinel EngineerExperience: 5 - 8 yrs

Location: Chennai/Bangalore/Hyderabad/Coimbatore

Key Responsibilities:

• Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment, including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks.

• Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial triage, investigate suspicious activities, and support incident response and escalation.

• Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and detection use cases to reduce false positives and improve threat detection.

• Integration with Managed SecOps: Support onboarding and integration of the client's Sentinel environment with the Managed SecOps processes, tools, workflows, and escalation procedures.

• Data Connector Management: Validate existing integrations and configure or troubleshoot connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other supported security data sources.

• KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat hunting, investigations, detection engineering, and operational reporting.

• Transition & Knowledge Transfer: Review existing Sentinel configurations, document current operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent provider wherever access and cooperation are available.

• Operational Readiness: Help establish incident handling workflows, escalation matrices, reporting processes, and runbooks for the future co-managed service.

• Documentation & Reporting: Maintain technical documentation, incident investigation notes, configuration records, and transition status reports.

• Continuous Improvement: Identify gaps in logging, detection coverage, automation, and platform configuration, and recommend remediation actions.

Required Technical Skills:

• Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions.

• Proficiency in KQL for security investigations, threat hunting, and analytics rule development.

• Experience configuring and troubleshooting Sentinel data connectors and log ingestion.

• Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft 365 security telemetry.

• Experience with SIEM operations, security incident investigation, alert triage, and escalation.

• Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat hunting.

• Experience with Sentinel automation rules, playbooks, and Logic Apps.

• Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control.

• Strong troubleshooting, documentation, communication, and stakeholder management skills.

Preferred Qualifications:

• Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience.

• Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps environment.

• Experience with SIEM transitions, security platform onboarding, and co-managed SOC operating models.

• Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code practices.

Expected Deliverables:

• 1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage.

• 2. Maintain continuity of Sentinel platform support and agreed security monitoring activities.

• 3. Identify and address critical gaps in data ingestion, detection rules, and incident handling.

• 4. Integrate the client environment into the Managed SecOps workflows and escalation processes.

• 5. Document the existing configuration, operational procedures, and outstanding risks.

• 6. Support service transition, knowledge transfer, and readiness for the future co-managed Sentinel model.