Microsoft Sentinel Engineer - Security Operations in Bangalore, भारत

MS Sentinel EngineerExperience: 5 - 8 yrsLocation: Responsibilities:- Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment, including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks.- Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial triage, investigate suspicious activities, and support incident response and escalation.- Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and detection use cases to reduce false positives and improve threat detection.- Integration with Managed SecOps: Support onboarding and integration of the client's Sentinel environment with the Managed SecOps processes, tools, workflows, and escalation procedures.- Data Connector Management: Validate existing integrations and configure or troubleshoot connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other supported security data sources.- KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat hunting, investigations, detection engineering, and operational reporting.- Transition & Knowledge Transfer: Review existing Sentinel configurations, document current operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent provider wherever access and cooperation are available.- Operational Readiness: Help establish incident handling workflows, escalation matrices, reporting processes, and runbooks for the future co-managed service.- Documentation & Reporting: Maintain technical documentation, incident investigation notes, configuration records, and transition status reports.- Continuous Improvement: Identify gaps in logging, detection coverage, automation, and platform configuration, and recommend remediation https://jobeax.com/link/eamP5cEzvH0WL36D Technical Skills:- Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions.- Proficiency in KQL for security investigations, threat hunting, and analytics rule development.- Experience configuring and troubleshooting Sentinel data connectors and log ingestion.- Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft 365 security telemetry.- Experience with SIEM operations, security incident investigation, alert triage, and escalation.- Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat hunting.- Experience with Sentinel automation rules, playbooks, and Logic Apps.- Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control.- Strong troubleshooting, documentation, communication, and stakeholder management https://jobeax.com/link/Cexs453KRiH2S1rJ Qualifications:- Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience.- Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps environment.- Experience with SIEM transitions, security platform onboarding, and co-managed SOC operating models.- Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code https://jobeax.com/link/ki5ilK8C51Qyk0A7 Deliverables:- 1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage.- 2. Maintain continuity of Sentinel platform support and agreed security monitoring activities.- 3. Identify and address critical gaps in data ingestion, detection rules, and incident handling.- 4. Integrate the client environment into the Managed SecOps workflows and escalation processes.- 5. Document the existing configuration, operational procedures, and outstanding risks.- 6. Support service transition, knowledge transfer, and readiness for the future co-managed Sentinel model. (ref:hirist.tech)