24 of 24 Remote/Hybrid Kusto Query Language Jobs in London

similar role • Hands-on experience with SIEM platforms, ideally Microsoft Sentinel and Microsoft Defender • Proficiency in Kusto Query Language (KQL), including custom queries and detection logic • Experience working with Azure and associated cloud security services • Strong understanding of security monitoring, logging and threat detection • Experience with vulnerability ...

support. Experience applying Detection-as-Code, CI/CD, source control, and peer-review practices. Technical Knowledge and Skills Advanced Microsoft Sentinel administration, architecture, KQL, analytics rules, hunting, workbooks, watchlists, playbooks, and optimisation. Azure Monitor Agent, Azure Arc, Data Collection Rules, Log Analytics, custom tables, parsers, and custom ingestion. Windows ...

Skills & Experience: Hands‐on experience with: Open‐source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T‐Pot, Cowrie, OpenCanary, Zscaler Deception) Advanced KQL for detection engineering and threat hunting at scale Detection‐as‐code, CI/CD of detection content, and security content management Strong knowledge of adversary ...

MSSP, consultancy, financial services, critical infrastructure, or other highly regulated environment. Experience with threat intelligence platforms, malware analysis, scripting, or automation using PowerShell, Python, KQL, or similar technologies. Experience developing threat hunts, response playbooks, detection rules, or security orchestration and automation workflows. Experience with Microsoft security technologies such as: Microsoft ...

translate architecture and security standards into practical engineering solutions. Strong communication, documentation and stakeholder-engagement skills. Desirable Experience: Microsoft Sentinel, Log Analytics/KQL, Defender for Identity, Defender for Cloud Apps or Copilot for Security. Microsoft Graph, Python, Logic Apps, Azure Functions, policy-as-code, infrastructure-as-code or advanced ...

enterprise security controls across Azure, Microsoft Entra ID and the Microsoft security ecosystem. Engineer and maintain Microsoft Sentinel capabilities, including data connectors, analytics rules, KQL queries, workbooks, watchlists, automation rules and playbooks. Design, implement and optimise Microsoft Defender capabilities, including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender … cloud security architecture, platform hardening, technical security controls and security baselines. Experience onboarding and validating infrastructure, cloud, application, identity and security telemetry. Experience developing KQL queries, analytics rules, workbooks, automation and threat-hunting content. Experience conducting technical risk assessments, security-control validation and vulnerability-remediation support. Experience with REST APIs ...

response methodologies, digital forensics and frameworks such as MITRE ATT&CK and NIST. Exposure to Microsoft security technologies, threat hunting, scripting (PowerShell, Python or KQL) or forensic tooling would be advantageous. If you think this role is a fit, we'd love to hear from you. Reference ...

tooling and services we use and the backing to implement this. You’ll be an innovative collaborator with strong technical skills, particularly in using KQL and excellent communication skills, with an appetite for complex problem solving. Seize the opportunity to join a dynamic security team, reporting to the Head ...

enterprise environment. A strong record of designing, building, operating and evolving Microsoft Sentinel as a production security monitoring and response capability. Deep expertise in KQL and the engineering of analytics rules, hunting queries, workbooks and threat-informed detection content. Extensive experience designing telemetry architectures and onboarding security data, including connectors ...

environment. Key Skills & Experience: Strong background in Security Engineering, SOC, Detection Engineering, or Incident Response Hands-on experience with SIEM/XDR platforms and KQL, SPL, or LogScale Microsoft 365 security experience Threat hunting and detection engineering aligned to MITRE ATT&CK Python and/or PowerShell scripting EDR experience ...

security operations workflows: alert triage, incident handling, and vulnerability/finding remediation lifecycles Comfort with scripting to support automation and tooling (e.g. Python, KQL) Experience coordinating remediation across multiple engineering or platform teams, and keeping work moving to closure Working knowledge of cloud environments (e.g. AWS, Azure ...

Engineer or SOC Engineer Experience with Microsoft Sentinel and other SIEM solutions (Splunk, Rapid7, LogRhythm, McAfee or equivalent) Strong analytical mindset with hands-on KQL experience and familiarity with related Microsoft Security technologies Ability to lead and design automation and scripting within SIEM tooling Experience analysing cloud security risks ...

scale medical research. You will work closely with engineering, architecture and cloud teams to integrate security throughout the software development lifecycle. Microsoft Azure and KQL experience are essential , alongside relevant experience in CI/CD, Kubernetes, API security, security-as-code and security automation . This is a hands ...

rehosting, re‐platforming and refactoring, not just lift and shift. Infrastructure as Code and automation: Strong Terraform skills, plus scripting in PowerShell, Bash, SQL, KQL and Packer. Experience with Azure DevOps YAML pipelines and CI/CD is essential, including building security and code quality tools into those pipelines. Containers ...

Data Warehouse using SSIS (essential) Experience supporting Azure Data Factory, Data Lake, Event Hub and Databricks. (essential) Ability to understand and write T-SQL, Kusto, Python coding languages. (essential) Experience of supporting PowerBI, Business Objects reports. Communicates clearly and is skilled at adapting their communication style to meet ...

external attack surface management, penetration testing, security testing, threat intelligence or Red or Purple Teaming Experience with tools such as ServiceNow, Jira, Power BI, KQL, PowerShell or Python, or relevant cyber security training or certifications Additional Information Belonging at The AA At The AA, we value the unique perspectives, experiences ...

Required Proven experience in Security Operations or Cyber Security. Hands‐on experience with Splunk, log forwarding and SIEM administration. Strong analytical skills using SPL, KQL and/or SQL. Experience investigating security incidents, insider threats or data exfiltration. Knowledge of vulnerability management and security assurance within enterprise environments. #J ...

related security products for enterprise clients. You will partner with SOC analysts to advance threat protection and secure cloud adoption. The role requires strong KQL skills, SIEM experience, and Microsoft certifications (AZ-104, SC-200, AZ-500, AZ-305). It offers hybrid work with a monthly London office presence ...

models and platform fundamentals (Azure, Snowflake, Kubecost desirable). Experience with FinOps practices and cost management tools, particularly Kubecost and cloud-native cost portals (KQL desirable). Demonstrated ability to work cross-functionally with Finance and technical teams to support cost visibility and decision-making. ...

Responsibilities Lead delivery of tenant rationalisation and security remediation activities. Design, build and optimise Microsoft Sentinel detections and analytics rules. Develop and tune KQL queries to improve threat detection coverage. Translate SOC assessment findings into a prioritised delivery backlog. Coordinate implementation activities across technical teams. Validate security improvements and ensure … agreed acceptance criteria are met. Support testing, stakeholder engagement and delivery governance. Essential Skills & Experience Strong commercial experience with Microsoft Sentinel . Advanced KQL development and detection engineering expertise. Experience designing, building and tuning analytics rules and use cases. Security Operations Centre (SOC) delivery experience. Azure security and remediation experience. ...

failover exercises covering invocation, validation and return to primary, maintaining runbooks, responsibilities and test evidence Improve service‐health monitoring using Azure Monitor, Log Analytics, KQL and Application Insights. Map services to monitoring signals, tune alerts for actionability, routing and ownership, and distinguish customer‐facing status from operational diagnostics Troubleshoot production … assessing and validating disaster recovery, including dependency mapping, RTOs/RPOs, recovery procedures, restore testing and regional failover Experience with Azure Monitor, Log Analytics, KQL and Application Insights, including service‐health monitoring, alert tuning and troubleshooting distributed, API‐driven services Practical Terraform experience covering modules, state management and drift detection ...

guidance, helping customers optimize their security defenses and mitigate risks effectively. Microsoft Focus: Utilize your knowledge of Microsoft security products, including Azure, Microsoft Sentinel, KQL, and the Microsoft Defender suite, to offer tailored recommendations and solutions. Relationship Building: Build and nurture strong relationships with customers, acting as a reliable … business and providing informal leadership in cyber security matters. Strong understanding of Microsoft security products and technologies, with proficiency in Azure, Microsoft Sentinel, KQL, and the Microsoft Defender suite or related product lines. Deep understanding of attacker tradecraft and security hardening techniques, enabling you to offer valuable insights and recommendations ...

We’re looking for a Senior Application Security Engineer to join our expanding Information Security team. If you are a hands‐on AppSec expert who enjoys working deep in the SDLC, partnering with talented engineers ...

Gravitas Group in London is seeking a Cyber Security Engineer to lead and implement security controls across the organisation. This 12-month FTC focuses on hardening the security posture, delivering projects, and ensuring systems remain ...