13 of 13 Remote/Hybrid SIEM Jobs in the South East

and colleagues. Essential skills Strong experience designing and implementing technical security systems and controls. Advanced knowledge of at least three security technologies, such as SIEM, Defender, Sentinel, EDR/XDR, Active Directory, Nessus, PAM, AWS IAM or Entra. Extensive knowledge of security controls across Windows, Linux, mainframe, AWS or Azure ...

and responding to cloud security threats, managing incidents end to end, and advising stakeholders on how to maintain a strong security posture Experience with SIEM tooling, ideally Microsoft Sentinel, along with a strong understanding of Zero Trust principles, modern authentication and secure baseline configuration, will be highly valuable ...

and responding to cloud security threats, managing incidents end to end, and advising stakeholders on how to maintain a strong security posture Experience with SIEM tooling, ideally Microsoft Sentinel, along with a strong understanding of Zero Trust principles, modern authentication and secure baseline configuration, will be highly valuable ...

identify and respond to threats effectively. This is not a generalist cyber security role. Key Responsibilities Administer and optimise Microsoft Sentinel (or equivalent SIEM), including log ingestion, parsing, normalisation, and retention. Develop and maintain SOAR workflows and automation using Azure Logic Apps, Python, PowerShell, Bash, and KQL. Onboard and manage … range of data sources. Design, implement, and tune detection rules to improve alert quality and reduce false positives. Conduct proactive threat hunting using SIEM, EDR, and threat intelligence sources. Support incident investigations, containment, and response activities. Monitor and maintain the health of SOC tooling, sensors, agents, and log pipelines. Produce ...

seeking a Security Engineer to lead customer security transformations focused on Microsoft Security and Azure Sentinel. You will drive end-to-end deployments across SIEM, XDR, Endpoint Security, Cloud Security and Identity, while advising executives and IT leaders on secure architectures. The ideal candidate has hands-on experience with Microsoft ...

Asset & Application Visibility Programme — bringing continuous, automated discovery to the full estate • Zero Trust enforcement — identity-aware access across remote and internal services • SIEM engineering, detection tuning, and vulnerability management — focused on outcomes and automation • Data Loss Prevention and Identity Lifecycle controls (JML) in Entra ID and key SaaS platforms … security engineering or architecture, with clear technical depth and autonomy • Proven hands-on delivery across cloud security (GCP/AWS), identity (Entra ID), SIEM/detection engineering, DLP, or zero trust — ideally three or more • Strong foundations in networking, operating systems, identity protocols, and cloud architecture • A track record ...

activity, emerging attack techniques, and advanced threats. ·Develop and execute hypothesis-driven threat hunts utilising datasets across a variety of security tooling, including EDR, SIEM, and network-layer defences. ·Collaborate directly with the Cyber Threat Intelligence team to operationalise intelligence, maintaining and refining hunting playbooks for priority threat actors and … logic. ·Proficiency in complex query writing (e.g., KQL, SPL, SQL) to filter, analyse, and visualise large, disparate datasets. Hands-on experience with EDR, NDR, SIEM, SOAR security platforms and data analysis platforms such as Databricks. Strong investigative acumen combined with a curious, highly analytical mindset capable of navigating ambiguity. ·Proven ...

using automation, scripting and best practice. Ensure detections are clearly documented and operationally usable. What youll bring: Experience in SOC engineering, detection engineering or SIEM engineering. Strong hands-on experience with Microsoft Sentinel and Splunk. Solid knowledge of KQL and SPL. Experience building, testing and maintaining detection rules. Good understanding … SIEM lifecycle management and security telemetry. Knowledge of cloud environments and IT infrastructure. Familiarity with frameworks such as MITRE ATT&CK. Ability to analyse threats and translate them into detection capability. Nice to have: Experience with SOAR (Logic Apps/Splunk SOAR). Detection-as-code or CI/ ...

Cyber Consultant to help organisations enhance their Security Operations and threat detection capabilities. This is a client-facing role focused on designing and delivering SIEM, XDR and SOAR solutions, developing detection content, automating security processes, and improving SOC effectiveness. You will lead detection engineering initiatives, create use cases aligned … MITRE ATT&CK, develop response playbooks, and implement Detection-as-Code best practices. Key Requirements Experience with SIEM platforms (Microsoft Sentinel preferred) Strong KQL and detection engineering skills SOAR automation and playbook development experience Python and/or PowerShell scripting XDR/EDR experience Knowledge of MITRE ATT&CK and ...

Zero Trust and secure-by-design principles Lead Microsoft Sentinel implementations including data connector configuration, KQL analytics rule development, Logic Apps playbook automation, and SIEM tuning to reduce false positives and improve MTTR Assess and optimise client Defender XDR and Sentinel configurations, producing detailed remediation and maturity roadmaps aligned … and MITRE ATT&CK best practices Advise on Defender XDR, Sentinel, and Entra ID integration to enable holistic security visibility, supporting migrations from Legacy SIEM platforms such as Splunk Collaborate with SOC and Incident Response teams during escalated incidents, rapidly onboarding critical assets and integrating key data sources for containment ...

/Unix servers, network devices and applications to the PAM platform Configure Just-in-Time (JIT) access workflows and approval processes Integrate PAM with SIEM tools for monitoring and alerting Manage platform upgrades, patching and ongoing health monitoring Troubleshoot connector issues and session failures Maintain technical documentation and support audit … credential vaulting, password rotation and privileged access workflows Experience onboarding systems into PAM platforms Strong understanding of Active Directory privileged account management Experience with SIEM integration Ability to obtain SC level security clearance If this sounds like a role for you please apply with an up to date version ...

About Us Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them ...

Blue Team Certifications Perhaps a few years of deeply technical hands on around Infrastructure, Linux, System Admin, maybe some time spent in CLOUD borne SIEM Azure, SOAR, MS Sentinel, other SIEM experience well regarded Some strong t3/Incident response experience Knowledge share/mentoring and guidance for less senior ...