We are seeking highly skilled and motivated Azure Sentinel SME - L2 to join our team. As an Azure Sentinel SME, you will be responsible for implementing and maintaining security measures in Azure Sentinel. You will work closely with different type of customers to provide guidance on security best practices, and play a crucial role in maintaining a secure and compliant infrastructure.
What you will do
Must Have:
- Should have done SIEM Engineering activities.
- Hands on Experience to Configure, manage, and maintain the Microsoft Sentinel SIEM platform including log management, retention configurations, maintenance of logs at low cost.
- Monitor, analyze, investigate and respond to security incidents in MS Sentinel by collaborating with the SOC team and Customers.
- Should be able to Integrate/onboard devices (Linux, Palo Alto, Fortinet, Windows and other devices etc.) to Azure Sentinel.
- Should have expertise in integrating data sources which are not supported by Sentinel tool OOB.
- Custom parser development and ability to solve technical issues in Sentinel.
- Troubleshoot and resolve issues related to SIEM (Sentinel) infrastructure and integrations like logs not reporting to Sentinel.
- Creation of integration documents and sending them to customers as per requirement.
- Strong Knowledge of different Microsoft Defender products
- Generate and review Weekly/Monthly reports to provide insights on security posture and SIEM effectiveness to Customers
- Regularly review use case performance and keep track of any fine tuning done to use cases including identifying scenarios where fine tuning can be done and effectively communicate to customer/internal for fine tuning.
- Act as single point of contact for the client during any issues of Integration or Incidents.
Good to Have:
- Creation and Fine Tuning in Custom KQL queries and functions for complex detection and monitoring
- Knowledge of Workbooks creation,
- Building Playbooks (Enrichment and Response) in Sentinel automation through logic apps.
- Preference should be given to candidates who have completed expert training and certifications in Sentinel and Defender products of Microsoft.
IMPORTANT CRITERIA:
- Strong communication, collaboration and multi-tasking skills to work effectively with cross-functional teams and stakeholders.
- Relevant skilled certifications such as: AZ-900, SC-900, SC-200, Certified Ethical Hacker (CEH) or any other SIEM Engineering certification.
- Stay updated with the latest trends and developments in SIEM technologies and cybersecurity threats and utilize it in the system if required.
Disclaimer: This job posting & Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.