MS Sentinel Engineer

MS Sentinel Engineer

Experience -5 to 8yrs

Location-Chennai/Bangalore/Hyderabad/Coimbatore

Key Responsibilities

• Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment,

including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks.

• Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial

triage, investigate suspicious activities, and support incident response and escalation.

• Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and

detection use cases to reduce false positives and improve threat detection.

• Integration with Managed SecOps: Support onboarding and integration of the client’s Sentinel

environment with the Managed SecOps processes, tools, workflows, and escalation procedures.

• Data Connector Management: Validate existing integrations and configure or troubleshoot

connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other

supported security data sources.

• KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat

hunting, investigations, detection engineering, and operational reporting.

• Transition & Knowledge Transfer: Review existing Sentinel configurations, document current

operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent

provider wherever access and cooperation are available.

• Operational Readiness: Help establish incident handling workflows, escalation matrices,

reporting processes, and runbooks for the future co-managed service.

• Documentation & Reporting: Maintain technical documentation, incident investigation notes,

configuration records, and transition status reports.

• Continuous Improvement: Identify gaps in logging, detection coverage, automation, and

platform configuration, and recommend remediation actions.

Confidential and Proprietary Page 2

Required Technical Skills

• Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions.

• Proficiency in KQL for security investigations, threat hunting, and analytics rule development.

• Experience configuring and troubleshooting Sentinel data connectors and log ingestion.

• Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID,

and Microsoft 365 security telemetry.

• Experience with SIEM operations, security incident investigation, alert triage, and escalation.

• Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat

hunting.

• Experience with Sentinel automation rules, playbooks, and Logic Apps.

• Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control.

• Strong troubleshooting, documentation, communication, and stakeholder management skills.

Preferred Qualifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience.

• Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps

environment.

• Experience with SIEM transitions, security platform onboarding, and co-managed SOC

operating models.

• Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code

practices.

Expected Deliverables

1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage.

2. Maintain continuity of Sentinel platform support and agreed security monitoring activities.

3. Identify and address critical gaps in data ingestion, detection rules, and incident handling.

4. Integrate the client environment into the Managed SecOps workflows and escalation

processes.

5. Document the existing configuration, operational procedures, and outstanding risks.

6. Support service transition, knowledge transfer, and readiness for the future co-managed

Sentinel model.

Pay: ₹800,000.00 - ₹1,800,000.00 per year

Work Location: In person