SC Cleared Security Consultant

Job Description We're looking for a hands-on Microsoft Sentinel engineer to get security data flowing reliably into Sentinel on a large Microsoft cloud security modernisation programme. You'll connect data sources, configure Azure Monitor Agent and Data Collection Rules, and fix ingestion problems across several Azure environments.

The aim is security telemetry that is complete, trustworthy and easy to support once you hand it over. This is an engineering role, not a SOC analyst or Microsoft 365 admin role. We need someone who has built and troubleshot Sentinel ingestion themselves, ideally in multi-tenant or MSSP-style environments.

What you'll be doing Configuring and troubleshooting Microsoft Sentinel data connectors Setting up Azure Monitor Agent (AMA) and Data Collection Rules (DCRs) Building and fixing security log-routing and ingestion pipelines Writing and adapting KQL queries to validate ingestion and diagnose problems Making parsing and normalisation changes where needed Testing data completeness, quality and ingestion latency Finding and fixing failed, incomplete or unreliable data feeds Monitoring connector health and improving reliability Onboarding and stabilising security data across multiple Azure environments Writing configuration, testing and operational support documentation By the end of the engagement you'll have delivered working connectors, validated data flows with test evidence, a connector health baseline, and documentation the support team can run with.

What you'll bring Strong hands-on Microsoft Sentinel engineering experience Practical experience configuring and troubleshooting Sentinel data connectors In-depth knowledge of Azure Monitor Agent and Data Collection Rules Good working knowledge of KQL Experience with security log pipelines, ingestion, parsing and normalisation Experience testing and validating security telemetry Strong integration and troubleshooting skills A solid understanding of Azure security and SOC/SIEM environments Nice to have Microsoft Defender products (Defender XDR, Defender for Endpoint, Defender for Cloud) Azure Monitor and Log Analytics Microsoft Entra ID and Microsoft 365 security data Syslog/CEF ingestion Windows Security Events Custom log and API-based ingestion SIEM migration or consolidation projects Multi-tenant or MSSP-style Sentinel environments ASAP - End of March

Report this job