SIEM Content & Platform Engineer | Hybrid London (2 Days Per Week) | £550pd Outside IR35

SIEM Content & Platform Engineer | Hybrid London (2 Days Per Week) | £550pd Outside IR35 | 5 Month Initial Contract

We're currently looking for an experienced SIEM Content & Platform Engineer to join a Cyber Security team.

Role: SIEM Content & Platform Engineer
Location: London (2 days per week onsite, remainder remote)
Duration: Initial 5 Month Contract
Rate: £550
IR35: Outside IR35
Start Date: ASAP

The Role:
You will act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture and associated security platforms.

Key Responsibilities:

• Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms
• Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK
• Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations
• Develop logging standards, onboarding patterns, use-case documentation and governance for the detection engineering life cycle
• Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell and Python
• Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation and security control validation
• Support integration and engineering of endpoint, identity, cloud, network and infrastructure security controls with the SIEM and Defender ecosystem
• Build Sentinel Workbooks, platform health monitoring and KPI/KRI reporting
• Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures and support documentation
• Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting and technical support during critical incidents and major changes

Essential Experience:

• Proven experience in SIEM, detection or security platform engineering within a large enterprise environment
• Strong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity and Cloud
• Experience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation and contextual enrichment
• Experience onboarding infrastructure, cloud, application and security telemetry into a SIEM
• Practical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment and security control validation
• Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting and operational support
• Experience applying Detection-as-Code, CI/CD, source control and peer-review practices

Technical Skills:

• Microsoft Sentinel
• Microsoft Defender XDR
• Endpoint
• Identity
• Cloud
• KQL
• Analytics Rules
• Hunting
• Workbooks
• Watchlists
• Playbooks
• Azure Monitor Agent
• Azure Arc
• Data Collection Rules
• Log Analytics
• Custom Tables
• Parsers
• Custom Ingestion
• Windows Event Forwarding and Collection
• XPath Filtering
• Windows Event IDs
• Sysmon
• PowerShell Logging
• Azure Functions
• Logic Apps
• REST APIs
• PowerShell
• Python
• MITRE ATT&CK
• Detection Coverage Analysis
• Azure DevOps
• Git-Based CI/CD
• Infrastructure-as-Code Concepts
• Cribl

Soft Skills:

• Proactive, accountable and delivery-focused approach
• Strong analytical, troubleshooting and problem-solving capability
• Clear communication with technical, operational and management stakeholders
• Effective collaboration across teams, regions and technical disciplines
• Calm, structured delivery under pressure, with disciplined documentation and prioritisation
• Willingness to provide planned out-of-hours support for critical upgrades and major changes when required

Qualifications:

• Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering or a related discipline
• SC-200 or AZ-500 desirable
• Additional cloud, SIEM, security engineering or automation certifications advantageous

To apply for this SIEM Content & Platform Engineer contract job, please click the button below and submit your latest CV.

Curo Services endeavours to respond to all applications, however this may not always be possible during periods of high volume. Thank you for your patience.

Curo Services is a trading name of Curo Resourcing Ltd and acts as an Employment Business for contract and temporary recruitment as well as an Employment Agency in relation to permanent vacancies.