1 to 25 of 26 Remote Kusto Query Language Jobs

Defender security products Security Operations Centre (SOC) environments SIEM technologies and security monitoring Incident response and threat detection Kusto Query Language (KQL) Security automation and Scripting Security engineering and continuous improvement initiatives Desirable certifications include: SC-200 AZ-500 AZ-104 The Person: The team is particularly ...

transformation initiatives. Desirable Skills: Experience implementing telemetry cost optimization and data reduction strategies at enterprise scale. Knowledge of Kusto Query Language (KQL) and large‐scale analytics platforms. Experience with Cribl, ADX, Datadog Pipelines, Splunk, Sentinel, Kafka, Event Hubs, Open Telemetry, Elastic, Grafana, or similar observability ecosystems. Ability ...

implementation and support of Microsoft Sentinel and Microsoft Defender/Defender XDR Engineering and optimisation of SIEM capabilities across enterprise environments Developing and tuning KQL queries, analytics and detection rules Designing and implementing SOC automation, playbooks and scripting Improving security event detection and response capabilities Conducting Microsoft tenant health checks … Experience To be considered, you should have strong commercial experience across the following: Microsoft Sentinel/Azure Sentinel Microsoft Defender/Defender XDR Strong KQL/Kusto Query Language capability Security Engineering, SOC Engineering or Microsoft Security Consulting SIEM engineering rather than solely alert monitoring or incident ...

cloud-based engineering principles. It would be great if you had: Experience in Cyber Security, SOC or Security Engineering environments. Microsoft Sentinel experience. KQL, SQL or other query language knowledge. Power BI data modelling, DAX and Power Query experience. Logic Apps, Power Automate or Azure Automation. Terraform ...

Networking, Security, Data) Strong hands-on experience with Kubernetes, Docker, and container orchestration Expertise in Infrastructure as Code (Terraform) and scripting (PowerShell, Bash, SQL, KQL) Proven delivery of CI/CD pipelines (Azure DevOps YAML essential) Experience implementing security tooling (SAST, DAST, container scanning, WAF) Strong knowledge of cloud security ...

Sentinel Splunk Enterprise Security Elastic Security Experience with EDR technologies including: Microsoft Defender XDR CrowdStrike Falcon SentinelOne Singularity Familiarity with: Windows Event Logs Sysmon KQL Sigma rules YARA PowerShell Python Memory analysis Malware triage Understanding of: Attack chains Identity-based attacks Cloud attack techniques Detection engineering principles Experience with adversary ...

incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working knowledge of several of: Microsoft Sentinel ...

QRadar SIEM Experience monitoring, triaging, and investigating security incidents Knowledge of incident response lifecycle and root cause analysis Experience with Microsoft Defender (essential) KQL knowledge desirable Ability to work independently and manage complex cyber investigations Technical Exposure: IBM QRadar Microsoft Defender/EDR Microsoft Sentinel (desirable) Microsoft Entra ID/ ...

Policy, Management Groups and subscription architecture Azure Migrate and associated discovery tooling Microsoft Defender for Cloud and Microsoft Sentinel Azure Monitor, Log Analytics and KQL Zero Trust architecture High availability and disaster recovery FinOps and cloud cost optimisation Use of GitHub Copilot to accelerate Infrastructure as Code development The Person ...

Enterprise architecture frameworks (TOGAF, SABSA, or equivalent)Strong understanding of data classification models, and risk scoringAbility to design and optimise enterprise Purview deploymentsKnowledge of KQL, PowerShell, and Microsoft Graph is a plus.Capability to analyse unstructured and structured data estatesAbility to lead technical teams and influence senior leadershipAbility to work across ...

frameworks (TOGAF, SABSA, or equivalent) Strong understanding of data classification models, and risk scoring Ability to design and optimise enterprise Purview deployments Knowledge of KQL, PowerShell, and Microsoft Graph is a plus. Capability to analyse unstructured and structured data estates Ability to lead technical teams and influence senior leadership Ability ...

frameworks (TOGAF, SABSA, or equivalent)* Strong understanding of data classification models, and risk scoring* Ability to design and optimise enterprise Purview deployments* Knowledge of KQL, PowerShell, and Microsoft Graph is a plus.* Capability to analyse unstructured and structured data estates* Ability to lead technical teams and influence senior leadership* Ability ...

functions, tooling, and detection capabilities. Key Responsibilities: Design and deliver detection rulesets across SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection … Requirements: Strong hands-on experience with SIEM engineering, including developing and tuning detection rules, with Microsoft Sentinel preferred Experience writing detection logic using KQL or similar query languages Proven experience designing and implementing SOAR automations and playbooks such as Logic Apps, Cortex XSOAR or similar Scripting and automation capability ...

identity lifecycle automation, ideally via the Microsoft Graph PowerShell SDK. Comfortable working independently and communicating migration risk/status to non-technical stakeholders. Desirable: KQL for log analysis in Microsoft Sentinel or Azure Monitor. Experience with Entra ID B2B/B2C. Background with an alternative IAM platform (ForgeRock, Ping, Okta ...

scale medical research. You will work closely with engineering, architecture and cloud teams to integrate security throughout the software development lifecycle. Microsoft Azure and KQL experience are essential, alongside relevant experience in CI/CD, Kubernetes, API security, security-as-code and security automation. This is a hands-on application ...

scale medical research. You will work closely with engineering, architecture and cloud teams to integrate security throughout the software development lifecycle. Microsoft Azure and KQL experience are essential, alongside relevant experience in CI/CD, Kubernetes, API security, security-as-code and security automation. This is a hands-on application ...

carry out malware analysis and threat validation. Design, implement and optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra … Microsoft Defender XDR, CrowdStrike Falcon and associated security technologies. Proven experience in incident response, threat hunting, malware analysis, digital forensics and security investigations. Advanced KQL skills, with the ability to develop and optimise complex detections and threat hunting queries. Strong scripting and automation experience using PowerShell and/or Python ...

engineers What you'll need Essential: A solid background as a Security Engineer or SOC Engineer Hands-on experience with Microsoft Security technologies and KQL Experience with SIEM platforms, for example Sentinel, Splunk, Rapid7 or LogRhythm Ability to lead and design automation and scripting in SIEM tools Experience analysing cloud ...

candidates will have 5-8 years in detection engineering or related roles, with deep expertise in Microsoft Sentinel, 365 Defender, Logic Apps, and strong KQL skills. #J-18808-Ljbffr ...

clearance requirement. What you'll be doing Designing and building detection rulesets across SIEM and XDR platforms Writing and tuning detection logic in KQL, cutting false positives without losing coverage Mapping customer log sources against use cases to identify and close coverage gaps Designing use cases aligned to MITRE … workshops, coverage assessments and use case catalogues as customer deliverables What we're looking for Hands-on SIEM engineering experience, ideally Microsoft Sentinel Confident KQL — this is the core of the role SOAR playbook design in Azure Logic Apps, Cortex XSOAR or similar Scripting in Python or PowerShell, and comfort ...

Experience translating hunts and red team findings into practical detections and improvements (signal selection, tuning, suppression/thresholding, entity mapping, documentation, and operational handoff) KQL depth and query performance: Comfortable using joins/unions, parsing, time-windowing, summarisation, Essential baselining, and performance-aware query patterns for large datasets ...

capability What we’re looking for: Strong SOC/Security Operations experience Hands-on SIEM engineering experience Detection engineering and alert tuning Experience with KQL, SQL or similar query languages Linux experience Threat hunting and incident response experience Scripting/automation using Python and/or PowerShell Exposure ...

doing Designing and maintaining the SIEM and XDR platform — data ingestion, log parsing and normalisation, retention, performance Writing and tuning detections in KQL, and building automation to cut manual analyst effort Scripting custom connectors and integrations across the security toolset Leading the technical onboarding of new customers alongside SOC Operations … looking for Around 3–5 years in a Security Operations Centre in an engineering or platform capacity Strong Microsoft Sentinel experience, with confident KQL Hands-on with Microsoft Defender and the wider Microsoft security stack — Intune, Entra ID, Defender for Endpoint Exposure to endpoint tooling such as CrowdStrike, Carbon Black ...

Working with Entra ID, MFA, Conditional Access and RBAC Using Microsoft Sentinel to monitor and investigate security events and incidents Writing and working with KQL queries Investigating suspicious activity, security incidents and emerging threats Supporting vulnerability management and remediation activity Working across the wider Microsoft security ecosystem Identifying opportunities … with: Microsoft Entra ID/Azure AD Identity & Access Management (IAM) Conditional Access Multi-Factor Authentication (MFA) Role-Based Access Control (RBAC) Microsoft Sentinel KQL/custom SIEM queries Microsoft 365/Microsoft security technologies Security incident investigation and remediation Vulnerability management Network and infrastructure security Windows and Linux environments ...

hypothesis-driven approaches. Investigate complex security incidents and provide technical escalation within the CSOC. Develop and optimise SIEM detections, analytics, use cases and KQL queries to improve threat detection and reduce false positives. Identify gaps in logging, monitoring and telemetry across cloud, identity, endpoint, network and application environments. Analyse threat … related technical discipline. Strong knowledge of cyber security operations, threat hunting, incident response and security monitoring. Experience with SIEM platforms (ideally Microsoft Sentinel), KQL or similar analytics tools. Good understanding of cloud, endpoint, identity, network and application security. Knowledge of security frameworks such as NIST or ISO 27001. Experience Proven ...