1 to 25 of 56 Permanent Kusto Query Language Jobs in the UK

following areas would be advantageous: Microsoft Azure Security AWS Security Services Google Cloud Platform (desirable) Microsoft Sentinel Kusto Query Language (KQL) CloudTrail, Azure Activity Logs and cloud audit logging Cloud Security Posture Management (CSPM) CrowdStrike Falcon Cloud Security Microsoft Defender Suite Kubernetes security concepts Identity and Access ...

Review and optimise existing Sentinel deployments, analytics rules, and workbooks Design, build, and tune threat‐detection use cases aligned with current threats Develop advanced KQL queries for monitoring, threat hunting, and investigations Integrate new data sources and improve security visibility across the estate Create and enhance automated response workflows using … Microsoft Sentinel SME within enterprise environments Strong expertise in Microsoft Sentinel architecture, deployment, and administration Advanced Kusto Query Language (KQL) skills Strong background in SIEM engineering, detection engineering, and threat hunting Experience with Microsoft Defender technologies including Defender XDR, Defender for Endpoint, Defender for Identity, and Defender ...

CodeQL understands code across these languages: we build and maintain the extractors that produce CodeQL databases and the libraries that model each language's structure and semantics. We maintain consistent feature coverage and support frequent language-version updates to keep CodeQL broadly available. You’ll create the conditions … best practices in creating high-quality, secure code.Machine learning applied to understanding source code or other structured data, specifically using prompt engineering with large language models (LLMs) and systematic benchmarking and evaluation of AI-based systems. Experience working in and leading a distributed team, including operating effectively across multiple ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

Security Operations Center (SOC) or incident response role Advanced proficiency with Microsoft Defender XDR and expert-level knowledge of Microsoft Sentinel, including KQL query writing and analytics rule development Strong hands-on experience with Microsoft Defender for Endpoint, including policy configuration and threat investigation Demonstrable experience responding to cyber ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

documentation, runbooks, and operational procedures. Skills & Experience Experience engineering and supporting SIEM platforms, ideally Microsoft Sentinel. Strong scripting and automation skills (Python, PowerShell, Bash, KQL). Experience with SOAR technologies and security automation. Knowledge of detection engineering and threat hunting. Strong understanding of Windows and Linux logging. Good networking knowledge ...

Skills & Experience:Hands-on experience with:Open-source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)Advanced KQL for detection engineering and threat hunting at scaleDetection-as-code, CI/CD of detection content, and security content managementStrong knowledge of adversary tradecraft ...

Skills & Experience: Hands-on experience with: Open-source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception) Advanced KQL for detection engineering and threat hunting at scale Detection-as-code, CI/CD of detection content, and security content management Strong knowledge of adversary ...

activities. Troubleshoot security monitoring, network, and infrastructure issues. Create technical documentation, operational procedures, and runbooks. Develop automation scripts and integrations using Python, PowerShell, SPL, KQL, and SQL. Support CI/CD pipelines using tools such as GitLab and Jenkins. Collaborate with security, infrastructure, and engineering teams to improve monitoring capabilities. ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection Hands‐on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security Strong understanding of cyber defence concepts, infrastructure security ...

Vault and Microsoft Defender for Cloud Azure App Services, Functions, Logic Apps, Storage Accounts and Azure SQL Azure Monitor, Log Analytics, Application Insights and KQL Experience supporting enterprise Azure Landing Zone environments Azure DevOps, Git and CI/CD pipelines Infrastructure as Code using Terraform, Bicep or ARM Templates Good ...

monitoring across cloud platforms, SaaS, and internal systems.Documenting security processes, tool configurations, and contributing to service delivery documentation.Supporting colleagues with ISO 27001 compliance and KQL-related tasks.What we are looking for:Previously worked as a Threat Detection Engineer or in a similar role.Must have strong expertise in KQL.Hands-on experience ...

MITRE ATT&CK, develop response playbooks, and implement Detection-as-Code best practices. Key Requirements Experience with SIEM platforms (Microsoft Sentinel preferred) Strong KQL and detection engineering skills SOAR automation and playbook development experience Python and/or PowerShell scripting XDR/EDR experience Knowledge of MITRE ...

Microsoft Sentinel. Proven ability to design and implement Conditional Access, identity protection, and device compliance policies. Experience developing detection rules, analytics, and automation using KQL and Sentinel playbooks. Solid understanding of Zero Trust architecture and practical implementation across enterprise environments. Strong knowledge of endpoint hardening, EDR tuning, and modern attack ...

incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working knowledge of several of: Microsoft Sentinel ...

Enterprise architecture frameworks (TOGAF, SABSA, or equivalent)Strong understanding of data classification models, and risk scoringAbility to design and optimise enterprise Purview deploymentsKnowledge of KQL, PowerShell, and Microsoft Graph is a plus.Capability to analyse unstructured and structured data estatesAbility to lead technical teams and influence senior leadershipAbility to work across ...

frameworks (TOGAF, SABSA, or equivalent) Strong understanding of data classification models, and risk scoring Ability to design and optimise enterprise Purview deployments Knowledge of KQL, PowerShell, and Microsoft Graph is a plus. Capability to analyse unstructured and structured data estates Ability to lead technical teams and influence senior leadership Ability ...

frameworks (TOGAF, SABSA, or equivalent)* Strong understanding of data classification models, and risk scoring* Ability to design and optimise enterprise Purview deployments* Knowledge of KQL, PowerShell, and Microsoft Graph is a plus.* Capability to analyse unstructured and structured data estates* Ability to lead technical teams and influence senior leadership* Ability ...

security risk clearly to engineering and product audiences. A growth mindset and genuine curiosity to keep learning. SC‐200 (Microsoft Security Operations Analyst) certification. KQL proficiency for detection rule authoring and threat hunting. Experience working in a similar fintech or financial services environment. All are welcome: At Flagstone ...

advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules). Deep execution knowledge of generating, managing, and analyzing Software Bills of Materials (SBOMs using frameworks like CycloneDX or SPDX ...

sourcesExperience in Python development, specifically contributing to a shared codebase used for automating SOC operationsMust have experience with one or more SIEM languages (SPL, KQL, SQL)Broad range of practical security knowledge across the spectrum of endpoint, network, identity, application, and cloud infrastructureKnowledge of attacker tactics, techniques, and procedures (TTPs ...

advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules).Deep execution knowledge of generating, managing, and analyzing Software Bills of Materials (SBOMs using frameworks like CycloneDX or SPDX) and integrating ...

evolve their detection capabilities.ResponsibilitiesKey responsibilities of the role include:DeliverDesign and deliver detection rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases … Skills and ExperienceStrong hands-on experience with SIEM engineering, including developing and tuning detection rules, with Microsoft Sentinel preferred Experience writing detection logic using KQL or similar query languages Proven experience designing and implementing SOAR automations and playbooks such as Logic Apps, Cortex XSOAR or similar Scripting and automation ...

operate and evolve their detection capabilities. Responsibilities Deliver Design and deliver detection rulesets across SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real‐world attack techniques Map customer log sources to detection … Experience Strong hands‐on experience with SIEM engineering, including developing and tuning detection rules, with Microsoft Sentinel preferred Experience writing detection logic using KQL or similar query languages Proven experience designing and implementing SOAR automations and playbooks such as Logic Apps, Cortex XSOAR or similar Scripting and automation capability ...