Sentinel Defender Consultant

Sentinel Defender Consultant

Location: Remote

Contract Type: Contract

Duration: 2 months

Rate: £440 - £490 per day INSIDE IR35

Overview

We are seeking an experienced Sentinel Defender to support the monitoring, investigation and response to cyber security incidents within a Microsoft security environment.

The successful candidate will play a key role in protecting business-critical systems through proactive threat detection, security monitoring and incident response activities.

Working as part of a wider Security Operations or Cyber Defence team, you will leverage Microsoft Sentinel and the Microsoft Defender suite to identify, investigate and remediate security threats across complex enterprise environments.

Key Responsibilities

• Monitor and investigate security alerts generated by Microsoft Sentinel and Microsoft Defender.


• Perform triage and analysis of security incidents to determine impact and appropriate response actions.


• Conduct threat hunting activities to identify suspicious or malicious activity.


• Analyse logs and security telemetry from multiple data sources.


• Create, tune and optimise Sentinel analytics rules, workbooks and detection use cases.


• Support incident response activities, including containment, eradication and recovery.


• Maintain and improve security monitoring and alerting capabilities.


• Work closely with infrastructure, cloud, networking and application teams during investigations.


• Produce clear incident reports and security documentation.


• Contribute to continuous improvement of SOC processes, playbooks and detection engineering activities.

Required Skills & Experience

• Strong hands-on experience with Microsoft Sentinel.


• Experience working with Microsoft Defender technologies, including:
  
  
  
  • Microsoft Defender for Endpoint
  
  
  • Microsoft Defender for Identity
  
  
  • Microsoft Defender for Cloud
  
  
  • Microsoft Defender for Office 365
  
  
  
  


• Experience investigating and responding to cyber security incidents.


• Strong understanding of security operations and incident response processes.


• Experience analysing Windows security events, Azure logs and cloud telemetry.


• Knowledge of cyber security frameworks, attack methodologies and threat actor tactics.


• Experience developing and tuning SIEM detections.


• Strong Kusto Query Language (KQL) skills.


• Ability to work independently within a Security Operations environment.


• Excellent analytical and problem-solving skills.

Desirable Skills

• Security Operations Centre (SOC) experience.


• Experience with Microsoft Defender XDR.


• Knowledge of MITRE ATT&CK framework.


• Experience with Azure security services.


• Experience building Sentinel workbooks and dashboards.


• Logic Apps and SOAR automation experience.


• Threat Intelligence integration experience.


• Microsoft security certifications

#J-18808-Ljbffr