SC Cleared Security Consultant

We're looking for a hands-on Microsoft Sentinel engineer to get security data flowing reliably into Sentinel on a large Microsoft cloud security modernisation programme.

You'll connect data sources, configure Azure Monitor Agent and Data Collection Rules, and fix ingestion problems across several Azure environments. The aim is security telemetry that is complete, trustworthy and easy to support once you hand it over.
This is an engineering role, not a SOC analyst or Microsoft 365 admin role. We need someone who has built and troubleshot Sentinel ingestion themselves, ideally in multi-tenant or MSSP-style environments.

What you'll be doing

• Configuring and troubleshooting Microsoft Sentinel data connectors
• Setting up Azure Monitor Agent (AMA) and Data Collection Rules (DCRs)
• Building and fixing security log-routing and ingestion pipelines
• Writing and adapting KQL queries to validate ingestion and diagnose problems
• Making parsing and normalisation changes where needed
• Testing data completeness, quality and ingestion latency
• Finding and fixing failed, incomplete or unreliable data feeds
• Monitoring connector health and improving reliability
• Onboarding and stabilising security data across multiple Azure environments
• Writing configuration, testing and operational support documentation

By the end of the engagement you'll have delivered working connectors, validated data flows with test evidence, a connector health baseline, and documentation the support team can run with.

What you'll bring

• Strong hands-on Microsoft Sentinel engineering experience
• Practical experience configuring and troubleshooting Sentinel data connectors
• In-depth knowledge of Azure Monitor Agent and Data Collection Rules
• Good working knowledge of KQL
• Experience with security log pipelines, ingestion, parsing and normalisation
• Experience testing and validating security telemetry
• Strong integration and troubleshooting skills
• A solid understanding of Azure security and SOC/SIEM environments

• Microsoft Defender products (Defender XDR, Defender for Endpoint, Defender for Cloud)
• Azure Monitor and Log Analytics
• Microsoft Entra ID and Microsoft 365 security data
• Syslog/CEF ingestion
• Windows Security Events
• Custom log and API-based ingestion
• SIEM migration or consolidation projects
• Multi-tenant or MSSP-style Sentinel environments