Security Engineer - SIEM, KQL- sought by investment bank based in London
Inside IR35 - 3 days a week on-site
Key Responsibilities
* SIEM Management & Optimization:
o Design, implement, and maintain Microsoft Sentinel workspaces, connectors, analytics rules, and playbooks
o Develop advanced KQL queries for threat hunting and reporting
o Optimize SIEM performance, cost, and data retention policies
o Troubleshoot log ingestion and parsing issues
* Log Source Integration:
o Onboard and configure critical log sources (AD, firewalls, servers, cloud infrastructure)
o Manage event collection and forwarding infrastructure
o Implement data filtering and custom log parsing
* Threat Detection & Use Case Development:
o Develop and refine detection rules based on threat intelligence and attack patterns
o Continuously improve detection efficacy and reduce false positives
* Security Monitoring & Incident Response:
o Monitor systems for anomalies and malicious activity
o Contribute to threat hunting and incident response playbooks
o Provide expert guidance on securing applications and infrastructure
* Security Advisory & Innovation:
o Support PoCs for new security tools
o Help define and measure control effectiveness
Required Skills & Experience
* 3+ years in a Security Engineer, SOC Analyst, or similar role
* Hands‑on experience with Microsoft Sentinel and KQL
* Strong knowledge of Active Directory, Windows/Linux systems, and cloud platforms (Azure, AWS, GCP)
* Proficiency in scripting (PowerShell, Python)
* Familiarity with security frameworks (MITRE ATT&CK, NIST, Kill Chain)
* Experience with EDR, DLP, Proxy, and SEG tools
* Certifications: AZ-500, SC-200, SC-900, CompTIA Security+, CISSP, GCIA, GCIH, GCFA, CCSP
* Experience with SOAR playbooks, YARA rules, STIX, and YAML
* Participation in red/purple team exercises
Desirable Qualifications
* Additional relevant certifications or exposure to emerging security technologies
For further details, please apply within. Alex Reeder – Harvey Nash
#J-18808-Ljbffr