1 to 25 of 67 Kusto Query Language Jobs in the UK

into Microsoft Sentinel . Develop and maintain analytics rules, alerting capabilities and detection use cases. Create and optimise Kusto Query Language (KQL) queries for threat hunting, incident investigation and reporting. Integrate and onboard new log sources and security tooling into Sentinel. Configure and support Azure Monitor … Analytics Azure Monitor Microsoft Defender XDR Microsoft Defender for Endpoint Microsoft Defender for Cloud Microsoft 365 Security Kusto Query Language (KQL) Azure Logic Apps Azure Lighthouse Experience Minimum 5 years' experience within Cyber Security, Security Engineering, SOC, SIEM Engineering or related disciplines. Strong understanding of SIEM, SOAR ...

into Microsoft Sentinel . Develop and maintain analytics rules, alerting capabilities and detection use cases. Create and optimise Kusto Query Language (KQL) queries for threat hunting, incident investigation and reporting. Integrate and onboard new log sources and security tooling into Sentinel. Configure and support Azure Monitor … Analytics Azure Monitor Microsoft Defender XDR Microsoft Defender for Endpoint Microsoft Defender for Cloud Microsoft 365 Security Kusto Query Language (KQL) Azure Logic Apps Azure Lighthouse Experience Minimum 5 years' experience within Cyber Security, Security Engineering, SOC, SIEM Engineering or related disciplines. Strong understanding of SIEM, SOAR ...

following areas would be advantageous: Microsoft Azure Security AWS Security Services Google Cloud Platform (desirable) Microsoft Sentinel Kusto Query Language (KQL) CloudTrail, Azure Activity Logs and cloud audit logging Cloud Security Posture Management (CSPM) CrowdStrike Falcon Cloud Security Microsoft Defender Suite Kubernetes security concepts Identity and Access ...

Review and optimise existing Sentinel deployments, analytics rules, and workbooks Design, build, and tune threat‐detection use cases aligned with current threats Develop advanced KQL queries for monitoring, threat hunting, and investigations Integrate new data sources and improve security visibility across the estate Create and enhance automated response workflows using … Microsoft Sentinel SME within enterprise environments Strong expertise in Microsoft Sentinel architecture, deployment, and administration Advanced Kusto Query Language (KQL) skills Strong background in SIEM engineering, detection engineering, and threat hunting Experience with Microsoft Defender technologies including Defender XDR, Defender for Endpoint, Defender for Identity, and Defender ...

translate security risks, technical findings and recommended actions for technical and non-technical audiences. Experience using PowerShell or Kusto Query Language (KQL) to support analysis, monitoring, and automation. Exposure to coding (e.g. Python) combined with a demonstrable ability to work with accuracy and attention to detail. Cyber ...

CodeQL understands code across these languages: we build and maintain the extractors that produce CodeQL databases and the libraries that model each language's structure and semantics. We maintain consistent feature coverage and support frequent language-version updates to keep CodeQL broadly available. You’ll create the conditions … best practices in creating high-quality, secure code.Machine learning applied to understanding source code or other structured data, specifically using prompt engineering with large language models (LLMs) and systematic benchmarking and evaluation of AI-based systems. Experience working in and leading a distributed team, including operating effectively across multiple ...

Security & Modern Infrastructure: Proficiency with AWS/Azure cloud security, containerised environments, and SaaS-based security solutions. Programming & Scripting: Advanced skills in Python, PowerShell, KQL, SPL, and SQL for automation, custom integrations, and advanced analytics development. Security Certifications: Professional certifications such as CISSP, GCIH, GCFA, Splunk Certified Architect, or Microsoft ...

Security & Modern Infrastructure: Proficiency with AWS/Azure cloud security, containerized environments, and SaaS-based security solutions. Programming & Scripting: Advanced skills in Python, PowerShell, KQL, SPL, and SQL for automation, custom integrations, and advanced analytics development. Security Certifications: Professional certifications such as CISSP, GCIH, GCFA, Splunk Certified Architect, or Microsoft ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

Security Operations Center (SOC) or incident response role Advanced proficiency with Microsoft Defender XDR and expert-level knowledge of Microsoft Sentinel, including KQL query writing and analytics rule development Strong hands-on experience with Microsoft Defender for Endpoint, including policy configuration and threat investigation Demonstrable experience responding to cyber ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection: Hands-on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security: Strong understanding of cyber defence concepts, infrastructure security ...

documentation, runbooks, and operational procedures. Skills & Experience Experience engineering and supporting SIEM platforms, ideally Microsoft Sentinel. Strong scripting and automation skills (Python, PowerShell, Bash, KQL). Experience with SOAR technologies and security automation. Knowledge of detection engineering and threat hunting. Strong understanding of Windows and Linux logging. Good networking knowledge ...

Skills & Experience:Hands-on experience with:Open-source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)Advanced KQL for detection engineering and threat hunting at scaleDetection-as-code, CI/CD of detection content, and security content managementStrong knowledge of adversary tradecraft ...

Skills & Experience: Hands-on experience with: Open-source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception) Advanced KQL for detection engineering and threat hunting at scale Detection-as-code, CI/CD of detection content, and security content management Strong knowledge of adversary ...

activities. Troubleshoot security monitoring, network, and infrastructure issues. Create technical documentation, operational procedures, and runbooks. Develop automation scripts and integrations using Python, PowerShell, SPL, KQL, and SQL. Support CI/CD pipelines using tools such as GitLab and Jenkins. Collaborate with security, infrastructure, and engineering teams to improve monitoring capabilities. ...

Vault and Microsoft Defender for Cloud Azure App Services, Functions, Logic Apps, Storage Accounts and Azure SQL Azure Monitor, Log Analytics, Application Insights and KQL Experience supporting enterprise Azure Landing Zone environments Azure DevOps, Git and CI/CD pipelines Infrastructure as Code using Terraform, Bicep or ARM Templates Good ...

Endpoint and Defender for Cloud; SIEM/SOC operations; Azure Logic Apps; vulnerability remediation; incident response. Threat Hunting & Detection Hands‐on experience using KQL, Microsoft Defender XDR, and threat intelligence sources to hunt threats and support investigations. Cyber Defence & Infrastructure Security Strong understanding of cyber defence concepts, infrastructure security ...

monitoring across cloud platforms, SaaS, and internal systems.Documenting security processes, tool configurations, and contributing to service delivery documentation.Supporting colleagues with ISO 27001 compliance and KQL-related tasks.What we are looking for:Previously worked as a Threat Detection Engineer or in a similar role.Must have strong expertise in KQL.Hands-on experience ...

operations (coverage management, escalation handling, policy tuning). Familiarity with Microsoft Defender suite and/or Microsoft Sentinel. Scripting/automation skills (PowerShell, KQL, Python). Knowledge of ransomware recovery patterns (immutable backups, restore validation, offline documentation). Exposure to audit/compliance requirements (ISO 27001, NIST, CIS) and evidence ...

Microsoft Sentinel to ensure complete and reliable security telemetry Develop custom parsers and data transformations to normalise and enrich ingested data Design and optimise KQL queries to support effective threat detection and investigation Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases Develop ...

Microsoft Sentinel to ensure complete and reliable security telemetry Develop custom parsers and data transformations to normalise and enrich ingested data Design and optimise KQL queries to support effective threat detection and investigation Create and maintain analytic rules and detection logic aligned to emerging threats and business use cases Develop ...

MITRE ATT&CK, develop response playbooks, and implement Detection-as-Code best practices. Key Requirements Experience with SIEM platforms (Microsoft Sentinel preferred) Strong KQL and detection engineering skills SOAR automation and playbook development experience Python and/or PowerShell scripting XDR/EDR experience Knowledge of MITRE ...

Microsoft Sentinel. Proven ability to design and implement Conditional Access, identity protection, and device compliance policies. Experience developing detection rules, analytics, and automation using KQL and Sentinel playbooks. Solid understanding of Zero Trust architecture and practical implementation across enterprise environments. Strong knowledge of endpoint hardening, EDR tuning, and modern attack ...

incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working knowledge of several of: Microsoft Sentinel ...

Enterprise architecture frameworks (TOGAF, SABSA, or equivalent)Strong understanding of data classification models, and risk scoringAbility to design and optimise enterprise Purview deploymentsKnowledge of KQL, PowerShell, and Microsoft Graph is a plus.Capability to analyse unstructured and structured data estatesAbility to lead technical teams and influence senior leadershipAbility to work across ...