51 to 71 of 71 Kusto Query Language Jobs in the UK excluding London

functions, tooling, and detection capabilities. Key Responsibilities: Design and deliver detection rulesets across SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection … Requirements: Strong hands-on experience with SIEM engineering, including developing and tuning detection rules, with Microsoft Sentinel preferred Experience writing detection logic using KQL or similar query languages Proven experience designing and implementing SOAR automations and playbooks such as Logic Apps, Cortex XSOAR or similar Scripting and automation capability ...

carry out malware analysis and threat validation. Design, implement and optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra … Microsoft Defender XDR, CrowdStrike Falcon and associated security technologies. Proven experience in incident response, threat hunting, malware analysis, digital forensics and security investigations. Advanced KQL skills, with the ability to develop and optimise complex detections and threat hunting queries. Strong scripting and automation experience using PowerShell and/or Python ...

cross-functional teams. You’ll bring 5+ years in Security Operations/Incident Response, strong SIEM/EDR experience, and hands-on skills in KQL/SPL, PowerShell and Python. #J-18808-Ljbffr ...

triage, threat hunting, data loss prevention, and operational risk analysis. * Demonstrable experience with at least one major SIEM and EDR platform, additional hands on KQL/SPL, PowerShell/Python experience preferred. * Demonstrable experience with Security Orchestration and Automation. * Certifications such as SC-200, AZ-500, GCIA/GCIH/ ...

Analytics, Defender for Cloud) Excellent understanding of cloud performance, IaaS/PaaS, networking fundamentals, API performance and capacity modelling Skilled in dashboards, log queries (KQL), custom metrics and performance analysis Ability to diagnose complex issues across infrastructure, networks, applications or databases Confident scripting and automation skills (PowerShell, Azure Automation, Graph ...

Analytics, Defender for Cloud) Excellent understanding of cloud performance, IaaS/PaaS, networking fundamentals, API performance and capacity modelling Skilled in dashboards, log queries (KQL), custom metrics and performance analysis Ability to diagnose complex issues across infrastructure, networks, applications or databases Confident scripting and automation skills (PowerShell, Azure Automation, Graph ...

security controls. Key Responsibilities Design, implement and optimise Microsoft Sentinel environments, including onboarding, configuration and continuous improvement Develop and tune Sentinel analytics rules using KQL, improving detection coverage and reducing false positives Support security monitoring, threat detection and incident investigation across enterprise environments Configure and enhance Microsoft Defender XDR capabilities … produce security documentation, recommendations and implementation plans Required Experience Strong commercial experience within Microsoft security engineering roles Hands-on experience with Microsoft Sentinel, including KQL, detection engineering and SIEM optimisation Strong knowledge of Microsoft Defender XDR security capabilities Experience with Microsoft Purview DLP, sensitivity labels and information protection Strong understanding ...

Sentinel, Defender XDR and Microsoft Purview, delivering scalable security solutions and improving detection coverage. The role requires hands-on experience with Sentinel analytics using KQL, Defender XDR capabilities, Azure security controls and IAM with Entra ID. #J-18808-Ljbffr ...

identify and remediate vulnerabilities. About you You’ll have strong hands-on experience in application security and ideally: Terraform and Python skills, with KQL advantageous. Experience securing GitHub/GitHub Actions, Kubernetes and APIs. Strong knowledge of application security testing and vulnerability management. Experience with DevSecOps, threat modelling and security ...

Cyber Security Operations - 6 months - Umbrella - 2 days on site in Head Office per week - £550/£575 Sentinel/Defender XDR and KQL proficient Able to pick up new tooling Outstanding communication skills Nice to haves but not essential Proofpoint, Tenable, Secure web gateway, purview. Role is monitor ...

Cyber Security Operations - 6 months - Umbrella - 2 days on site in Head Office per week - £550/£575 Sentinel/Defender XDR and KQL proficient Able to pick up new tooling Outstanding communication skills Nice to haves but not essential Proofpoint, Tenable, Secure web gateway, purview. Role is monitor ...

including escalation handling, stakeholder communication and corrective action tracking. Ability to report findings, operational analysis, service performance and improvement recommendations in clear and concise language to technical and non-technical stakeholders. Ability to work closely with cross functional teams on shared deployment, release, incident and customer experience objectives. Creative … APIs including Swagger, OAuth2 and ODATA. Experience with Relational DBMS systems including SQL and T-SQL. Experience with Azure Monitoring and Log Analytics, notably KQL, Python and PowerShell. Location: This role may be based in either our Dudley, United Kingdom office or our Plzeň, Czech Republic office. While the position ...

encryption. Ability to think critically under pressure and respond effectively to fast-moving security incidents. Scripting or query experience is highly desirable (SPL, KQL, etc.). Good communication skills from previous roles. Due to the nature and urgency of this post, candidates holding or who have held high level ...

clearance requirement. What you'll be doing Designing and building detection rulesets across SIEM and XDR platforms Writing and tuning detection logic in KQL, cutting false positives without losing coverage Mapping customer log sources against use cases to identify and close coverage gaps Designing use cases aligned to MITRE … workshops, coverage assessments and use case catalogues as customer deliverables What we're looking for Hands-on SIEM engineering experience, ideally Microsoft Sentinel Confident KQL — this is the core of the role SOAR playbook design in Azure Logic Apps, Cortex XSOAR or similar Scripting in Python or PowerShell, and comfort ...

Experience translating hunts and red team findings into practical detections and improvements (signal selection, tuning, suppression/thresholding, entity mapping, documentation, and operational handoff) KQL depth and query performance: Comfortable using joins/unions, parsing, time-windowing, summarisation, Essential baselining, and performance-aware query patterns for large datasets ...

Experience within a Security Operations Centre (SOC) Proficiency with IBM QRadar SIEM for monitoring and incident response Familiarity with common query languages, preferably KQL Understanding of security processes and controls in enterprise environments Ability to work independently with minimal supervision Technical skills in Microsoft Defender, Microsoft Sentinel ...

Line of Service Assurance Industry/Sector Not Applicable Specialism Risk Management Level Senior Manager Job Description & Summary About the role: We are seeking a Senior Manager to lead the day-to-day technical delivery ...

capability What we’re looking for: Strong SOC/Security Operations experience Hands-on SIEM engineering experience Detection engineering and alert tuning Experience with KQL, SQL or similar query languages Linux experience Threat hunting and incident response experience Scripting/automation using Python and/or PowerShell Exposure ...

doing Designing and maintaining the SIEM and XDR platform — data ingestion, log parsing and normalisation, retention, performance Writing and tuning detections in KQL, and building automation to cut manual analyst effort Scripting custom connectors and integrations across the security toolset Leading the technical onboarding of new customers alongside SOC Operations … looking for Around 3–5 years in a Security Operations Centre in an engineering or platform capacity Strong Microsoft Sentinel experience, with confident KQL Hands-on with Microsoft Defender and the wider Microsoft security stack — Intune, Entra ID, Defender for Endpoint Exposure to endpoint tooling such as CrowdStrike, Carbon Black ...

Working with Entra ID, MFA, Conditional Access and RBAC Using Microsoft Sentinel to monitor and investigate security events and incidents Writing and working with KQL queries Investigating suspicious activity, security incidents and emerging threats Supporting vulnerability management and remediation activity Working across the wider Microsoft security ecosystem Identifying opportunities … with: Microsoft Entra ID/Azure AD Identity & Access Management (IAM) Conditional Access Multi-Factor Authentication (MFA) Role-Based Access Control (RBAC) Microsoft Sentinel KQL/custom SIEM queries Microsoft 365/Microsoft security technologies Security incident investigation and remediation Vulnerability management Network and infrastructure security Windows and Linux environments ...

hypothesis-driven approaches. Investigate complex security incidents and provide technical escalation within the CSOC. Develop and optimise SIEM detections, analytics, use cases and KQL queries to improve threat detection and reduce false positives. Identify gaps in logging, monitoring and telemetry across cloud, identity, endpoint, network and application environments. Analyse threat … related technical discipline. Strong knowledge of cyber security operations, threat hunting, incident response and security monitoring. Experience with SIEM platforms (ideally Microsoft Sentinel), KQL or similar analytics tools. Good understanding of cloud, endpoint, identity, network and application security. Knowledge of security frameworks such as NIST or ISO 27001. Experience Proven ...