•Microsoft Sentinel SIEM Expertise: In-depth knowledge of Microsoft Sentinel SIEM platform features and capabilities Experience with Sentinel’s data connectors, workbooks, and automation rules.
•UEBA Proficiency: Understanding of UEBA concepts, including anomaly detection, behavioral baselines, and threat modeling and Ability to implement and fine-tune UEBA strategies to detect unusual or malicious behavior.
•Kusto Query Language (KQL): Advanced skills in writing and optimizing KQL queries to create effective alerts, detections, and dashboards and Experience with query performance tuning and complex data aggregation.
•Scripting and Automation: Proficiency in scripting languages (e.g., PowerShell, Python) for automating tasks and developing custom integrations and Knowledge of Sentinel’s automation and orchestration capabilities.
•Data Analysis and Interpretation: Ability to analyze and interpret complex security data and trends and Skills in developing actionable insights from data patterns and anomalies
Responsibilities
SIEM Management
Deploy, configure, and maintain Microsoft Sentinel SIEM solution.
Integrate various log sources (cloud, on-prem, network, endpoints) into Sentinel.
Ensure data connectors and ingestion pipelines are optimized for performance and cost.
Security Monitoring & Analysis
Develop and maintain detection rules, analytics, and use cases in Sentinel.
Monitor alerts and dashboards for suspicious activities and anomalies.
Collaborate with SOC analysts for incident triage and investigation.
Automation & Optimization
Implement automation using Logic Apps and Playbooks for alert enrichment and response.
Optimize Sentinel workbooks, hunting queries, and dashboards for better visibility.
Compliance & Reporting
Generate compliance and security posture reports using Sentinel workbooks.
Ensure adherence to regulatory requirements (ISO, GDPR, etc.) through proper logging and monitoring.
Threat Hunting & Incident Response
Conduct proactive threat hunting using KQL (Kusto Query Language).
Assist in forensic analysis and root cause investigations.
Maintenance & Upgrades
Apply patches, updates, and maintain Sentinel health.
Monitor ingestion costs and optimize retention policies.