1 to 25 of 48 Kusto Query Language Jobs

into Microsoft Sentinel . Develop and maintain analytics rules, alerting capabilities and detection use cases. Create and optimise Kusto Query Language (KQL) queries for threat hunting, incident investigation and reporting. Integrate and onboard new log sources and security tooling into Sentinel. Configure and support Azure Monitor … Analytics Azure Monitor Microsoft Defender XDR Microsoft Defender for Endpoint Microsoft Defender for Cloud Microsoft 365 Security Kusto Query Language (KQL) Azure Logic Apps Azure Lighthouse Experience Minimum 5 years' experience within Cyber Security, Security Engineering, SOC, SIEM Engineering or related disciplines. Strong understanding of SIEM, SOAR ...

into Microsoft Sentinel . Develop and maintain analytics rules, alerting capabilities and detection use cases. Create and optimise Kusto Query Language (KQL) queries for threat hunting, incident investigation and reporting. Integrate and onboard new log sources and security tooling into Sentinel. Configure and support Azure Monitor … Analytics Azure Monitor Microsoft Defender XDR Microsoft Defender for Endpoint Microsoft Defender for Cloud Microsoft 365 Security Kusto Query Language (KQL) Azure Logic Apps Azure Lighthouse Experience Minimum 5 years' experience within Cyber Security, Security Engineering, SOC, SIEM Engineering or related disciplines. Strong understanding of SIEM, SOAR ...

security, including Microsoft Copilot, OpenAI, agentic AI or MCP implementations, would be highly advantageous Knowledge of Kusto Query Language (KQL) or CrowdStrike Query Language (CQL), with the ability to create queries for security investigations and reporting, would be a distinct advantage What's on offer ...

following areas would be advantageous: Microsoft Azure Security AWS Security Services Google Cloud Platform (desirable) Microsoft Sentinel Kusto Query Language (KQL) CloudTrail, Azure Activity Logs and cloud audit logging Cloud Security Posture Management (CSPM) CrowdStrike Falcon Cloud Security Microsoft Defender Suite Kubernetes security concepts Identity and Access ...

Storage Azure Functions Azure Monitor Azure Logic Apps Kubernetes Azure DevOps Programming & Automation Python PowerShell Bash Terraform SQL Kusto Query Language (KQL) GitHub CI/CD Pipelines Data Engineering ETL Pipeline Development Data Integration Data Modelling Data Warehousing Cloud Data Pipelines Data Cleansing & Transformation Real-Time Data ...

Review and optimise existing Sentinel deployments, analytics rules, and workbooks Design, build, and tune threat‐detection use cases aligned with current threats Develop advanced KQL queries for monitoring, threat hunting, and investigations Integrate new data sources and improve security visibility across the estate Create and enhance automated response workflows using … Microsoft Sentinel SME within enterprise environments Strong expertise in Microsoft Sentinel architecture, deployment, and administration Advanced Kusto Query Language (KQL) skills Strong background in SIEM engineering, detection engineering, and threat hunting Experience with Microsoft Defender technologies including Defender XDR, Defender for Endpoint, Defender for Identity, and Defender ...

translate security risks, technical findings and recommended actions for technical and non-technical audiences. Experience using PowerShell or Kusto Query Language (KQL) to support analysis, monitoring, and automation. Exposure to coding (e.g. Python) combined with a demonstrable ability to work with accuracy and attention to detail. Cyber ...

Security & Modern Infrastructure: Proficiency with AWS/Azure cloud security, containerised environments, and SaaS-based security solutions. Programming & Scripting: Advanced skills in Python, PowerShell, KQL, SPL, and SQL for automation, custom integrations, and advanced analytics development. Security Certifications: Professional certifications such as CISSP, GCIH, GCFA, Splunk Certified Architect, or Microsoft ...

Security & Modern Infrastructure: Proficiency with AWS/Azure cloud security, containerized environments, and SaaS-based security solutions. Programming & Scripting: Advanced skills in Python, PowerShell, KQL, SPL, and SQL for automation, custom integrations, and advanced analytics development. Security Certifications: Professional certifications such as CISSP, GCIH, GCFA, Splunk Certified Architect, or Microsoft ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

documentation, runbooks, and operational procedures. Skills & Experience Experience engineering and supporting SIEM platforms, ideally Microsoft Sentinel. Strong Scripting and automation skills (Python, PowerShell, Bash, KQL). Experience with SOAR technologies and security automation. Knowledge of detection engineering and threat hunting. Strong understanding of Windows and Linux logging. Good networking knowledge ...

activities. Troubleshoot security monitoring, network, and infrastructure issues. Create technical documentation, operational procedures, and runbooks. Develop automation scripts and integrations using Python, PowerShell, SPL, KQL, and SQL. Support CI/CD pipelines using tools such as GitLab and Jenkins. Collaborate with security, infrastructure, and engineering teams to improve monitoring capabilities. ...

Apps, Storage Accounts, and Azure databases, including configuration, scaling, resilience, and performance optimisation. Experience with Azure Monitor, Application Insights, Log Analytics, alerting, dashboards, and KQL-based troubleshooting. Strong understanding of SQL Server and Azure SQL, with exposure to Cosmos DB, Entra ID, Single Sign-On (SSO), and core Azure IaaS ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection Hands‐on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security Strong understanding of cyber defence concepts, infrastructure security ...

Vault and Microsoft Defender for Cloud Azure App Services, Functions, Logic Apps, Storage Accounts and Azure SQL Azure Monitor, Log Analytics, Application Insights and KQL Experience supporting enterprise Azure Landing Zone environments Azure DevOps, Git and CI/CD pipelines Infrastructure as Code using Terraform, Bicep or ARM Templates Good ...

operations (coverage management, escalation handling, policy tuning). Familiarity with Microsoft Defender suite and/or Microsoft Sentinel. Scripting/automation skills (PowerShell, KQL, Python). Knowledge of ransomware recovery patterns (immutable backups, restore validation, offline documentation). Exposure to audit/compliance requirements (ISO 27001, NIST, CIS) and evidence ...

Microsoft Sentinel to ensure complete and reliable security telemetry Develop custom parsers and data transformations to normalise and enrich ingested data Design and optimise KQL queries to support effective threat detection and investigation Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases Develop ...

MITRE ATT&CK, develop response playbooks, and implement Detection-as-Code best practices. Key Requirements Experience with SIEM platforms (Microsoft Sentinel preferred) Strong KQL and detection engineering skills SOAR automation and playbook development experience Python and/or PowerShell scripting XDR/EDR experience Knowledge of MITRE ...

MITRE ATT&CK, develop response playbooks, and implement Detection-as-Code best practices. Key Requirements Experience with SIEM platforms (Microsoft Sentinel preferred) Strong KQL and detection engineering skills SOAR automation and playbook development experience Python and/or PowerShell scripting XDR/EDR experience Knowledge of MITRE ...

Microsoft Sentinel. Proven ability to design and implement Conditional Access, identity protection, and device compliance policies. Experience developing detection rules, analytics, and automation using KQL and Sentinel playbooks. Solid understanding of Zero Trust architecture and practical implementation across enterprise environments. Strong knowledge of endpoint hardening, EDR tuning, and modern attack ...

frameworks (TOGAF, SABSA, or equivalent)* Strong understanding of data classification models, and risk scoring* Ability to design and optimise enterprise Purview deployments* Knowledge of KQL, PowerShell, and Microsoft Graph is a plus.* Capability to analyse unstructured and structured data estates* Ability to lead technical teams and influence senior leadership* Ability ...

security risk clearly to engineering and product audiences. A growth mindset and genuine curiosity to keep learning. SC‐200 (Microsoft Security Operations Analyst) certification. KQL proficiency for detection rule authoring and threat hunting. Experience working in a similar fintech or financial services environment. All are welcome: At Flagstone ...

advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules). Deep execution knowledge of generating, managing, and analyzing Software Bills of Materials (SBOMs using frameworks like CycloneDX or SPDX ...

Security Operations, monitoring, detection and response activities. Drive improvements across Microsoft Sentinel, Microsoft Defender and the wider M365 security ecosystem. Utilise KQL to enhance threat hunting, reporting, automation and detection capabilities. Manage third-party security vendors, ensuring service levels and contractual obligations are delivered. Support security audits, risk management activities ...