1 to 25 of 26 Kusto Query Language Jobs

Implement security best practices, including privileged access management and least privilege. Microsoft Sentinel Deploy, configure, and manage Microsoft Sentinel. Develop and maintain analytics rules, KQL queries, workbooks, and automation. Investigate security incidents and suspicious activity. Integrate Microsoft Sentinel with Active Directory, Microsoft 365, Defender, and other security platforms. Develop Logic … Services Group Policy DNS, DHCP, TCP/IP PowerShell Microsoft 365 Microsoft Entra ID Microsoft Defender Microsoft Sentinel Kusto Query Language (KQL) Windows Server Azure Hybrid identity and Exchange environments Security monitoring and incident response Please send your CV fo immediate interview ...

Security & Modern Infrastructure: Proficiency with AWS/Azure cloud security, containerised environments, and SaaS-based security solutions. Programming & Scripting: Advanced skills in Python, PowerShell, KQL, SPL, and SQL for automation, custom integrations, and advanced analytics development. Security Certifications: Professional certifications such as CISSP, GCIH, GCFA, Splunk Certified Architect, or Microsoft ...

documentation, runbooks, and operational procedures. Skills & Experience Experience engineering and supporting SIEM platforms, ideally Microsoft Sentinel. Strong scripting and automation skills (Python, PowerShell, Bash, KQL). Experience with SOAR technologies and security automation. Knowledge of detection engineering and threat hunting. Strong understanding of Windows and Linux logging. Good networking knowledge ...

Skills & Experience: Hands-on experience with: Open-source and commercial deception/honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception) Advanced KQL for detection engineering and threat hunting at scale Detection-as-code, CI/CD of detection content, and security content management Strong knowledge of adversary ...

Vault and Microsoft Defender for Cloud Azure App Services, Functions, Logic Apps, Storage Accounts and Azure SQL Azure Monitor, Log Analytics, Application Insights and KQL Experience supporting enterprise Azure Landing Zone environments Azure DevOps, Git and CI/CD pipelines Infrastructure as Code using Terraform, Bicep or ARM Templates Good ...

operations (coverage management, escalation handling, policy tuning). Familiarity with Microsoft Defender suite and/or Microsoft Sentinel. Scripting/automation skills (PowerShell, KQL, Python). Knowledge of ransomware recovery patterns (immutable backups, restore validation, offline documentation). Exposure to audit/compliance requirements (ISO 27001, NIST, CIS) and evidence ...

Analyst. Hands-on experience with SIEM (Splunk preferred; Microsoft Sentinel or equivalent also considered). Experience with M365 security tooling (e.g. Microsoft Defender, Sentinel, KQL). Good understanding of threat actors' tools, techniques and procedures . Strong analytical, problem-solving and communication skills. Nice to have Further experience with Splunk ...

incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working knowledge of several of: Microsoft Sentinel ...

scale medical research. You will work closely with engineering, architecture and cloud teams to integrate security throughout the software development lifecycle. Microsoft Azure and KQL experience are essential, alongside relevant experience in CI/CD, Kubernetes, API security, security-as-code and security automation. This is a hands-on application ...

SIEM) to support the investigation and response to cyber incidents. Experience working with Splunk Experience of M365 (MS Defender/Sentinel/KQL) Experience with cloud environment such as AWS This work has been determined as falling inside IR35. ...

Analytics, Defender for Cloud) Excellent understanding of cloud performance, IaaS/PaaS, networking fundamentals, API performance and capacity modelling Skilled in dashboards, log queries (KQL), custom metrics and performance analysis Ability to diagnose complex issues across infrastructure, networks, applications or databases Confident scripting and automation skills (PowerShell, Azure Automation, Graph ...

Analytics, Defender for Cloud) Excellent understanding of cloud performance, IaaS/PaaS, networking fundamentals, API performance and capacity modelling Skilled in dashboards, log queries (KQL), custom metrics and performance analysis Ability to diagnose complex issues across infrastructure, networks, applications or databases Confident scripting and automation skills (PowerShell, Azure Automation, Graph ...

identify and remediate vulnerabilities. About you You’ll have strong hands-on experience in application security and ideally: Terraform and Python skills, with KQL advantageous. Experience securing GitHub/GitHub Actions, Kubernetes and APIs. Strong knowledge of application security testing and vulnerability management. Experience with DevSecOps, threat modelling and security ...

incidents when required Escalate complex incidents with clear, detailed findings Support incident response, client communications and incident bridges Maintain runbooks, internal documentation and the KQL library Tune detections and manage improvement requests through Azure DevOps What we’re looking for Strong experience in a security operations or analytical role Hands … expertise with Microsoft Defender and Microsoft Sentinel Advanced KQL skills and a strong understanding of Log Analytics Broad knowledge of the Microsoft security stack Strong written and verbal communication skills, including confidence communicating with clients during high-priority incidents Desirable experience Python, Bicep, ARM templates or JSON Microsoft or security ...

models and platform fundamentals (Azure, Snowflake, Kubecost desirable). Experience with FinOps practices and cost management tools, particularly Kubecost and cloud-native cost portals (KQL desirable). Demonstrated ability to work cross-functionally with Finance and technical teams to support cost visibility and decision-making. ...

models and platform fundamentals (Azure, Snowflake, Kubecost desirable). Experience with FinOps practices and cost management tools, particularly Kubecost and cloud-native cost portals (KQL desirable). Demonstrated ability to work cross-functionally with Finance and technical teams to support cost visibility and decision-making. ...

maintain and tune the detection catalogue Build automated reporting dashboards using Microsoft Sentinel workbooks Support security initiatives including ISO 27001 activities and KQL-based tasks Ensure monitoring coverage across cloud platforms, SaaS apps, and internal systems Contribute to documentation of processes, tools, and detection logic What You’ll Bring Must … Have Skills & Experience: Previously worked as a Threat Detection Engineer or in a similar role. Strong proficiency in KQL and hands-on experience with Microsoft Sentinel Familiarity with Microsoft Defender tools (Endpoint & O365) Exposure to Azure cloud logging and Kubernetes environments Knowledge of attacker TTPs and MITRE ATT&CK frameworks ...

maintain and tune the detection catalogue Build automated reporting dashboards using Microsoft Sentinel workbooks Support security initiatives including ISO 27001 activities and KQL-based tasks Ensure monitoring coverage across cloud platforms, SaaS apps, and internal systems Contribute to documentation of processes, tools, and detection logic What You’ll Bring Must … Have Skills & Experience: Previously worked as a Threat Detection Engineer or in a similar role. Strong proficiency in KQL and hands-on experience with Microsoft Sentinel Familiarity with Microsoft Defender tools (Endpoint & O365) Exposure to Azure cloud logging and Kubernetes environments Knowledge of attacker TTPs and MITRE ATT&CK frameworks ...

senior stakeholders. A background in developing or improving vulnerability management strategies, frameworks or operating models. Strong knowledge of Microsoft security technologies. Experience using KQL to interrogate and report on security data. Excellent stakeholder management and communication skills. Previous experience within a regulated environment would be advantageous. ...

Security Engineer (SIEM/XDR) Microsoft Sentinel, Defender, Endpoint, Detection Engineering, Detection-as-Code, KQL, Security Automation, SOAR, Playbooks, Telemetry, Cloud Security, APIs, CI/CD, Infrastructure-as-Code, Python, PowerShell, Windows, Linux, Remote (with UK wide travel) This is an exceptional permanent Security Engineer (SIEM/XDR) opportunity … security engineering or detection engineering experience Hands-on SIEM and XDR tooling Microsoft Sentinel and Microsoft Defender for Endpoint Detection engineering, detection-as-code, KQL, security content and alert logic Automation, SOAR, playbooks, enrichment workflows and response improvement Scripting/programming with Python and/or PowerShell Infrastructure-as-code ...

JIRA Service Management. Detection Engineering Develop and implement new detection rules in Microsoft Sentinel aligned to the MITRE ATT&CK framework. Draft and optimise KQL queries for detection and threat hunting. Refine existing detection logic based on false positive analysis and threat evolution. Threat Intelligence & Enrichment Analyse threat intelligence feeds … hour) of Canary Wharf, London Technical Skills Familiarity with scripting and automation development (you do not need to be fluent in any particular coding language, but you should be able to demonstrate an understanding of how scripting and other tools (such as AI agents) can be used to streamline ...

clearance requirement. What you'll be doing Designing and building detection rulesets across SIEM and XDR platforms Writing and tuning detection logic in KQL, cutting false positives without losing coverage Mapping customer log sources against use cases to identify and close coverage gaps Designing use cases aligned to MITRE … workshops, coverage assessments and use case catalogues as customer deliverables What we're looking for Hands-on SIEM engineering experience, ideally Microsoft Sentinel Confident KQL — this is the core of the role SOAR playbook design in Azure Logic Apps, Cortex XSOAR or similar Scripting in Python or PowerShell, and comfort ...

capability What we’re looking for: Strong SOC/Security Operations experience Hands-on SIEM engineering experience Detection engineering and alert tuning Experience with KQL, SQL or similar query languages Linux experience Threat hunting and incident response experience Scripting/automation using Python and/or PowerShell Exposure ...

Engineering and maintaining Microsoft Sentinel , Defender XDR , and Log Analytics platforms Onboarding and normalising log sources across hybrid/cloud environments Writing and tuning KQL detection rules and analytics logic Building SOAR playbooks (Logic Apps, automation workflows) to reduce manual effort Managing telemetry ingestion, parsers, and data retention for cost … contributing to team development Acting as technical SME during incidents What we're looking for: Deep experience with Microsoft Sentinel , Defender suite , and KQL Strong scripting/automation skills ( PowerShell, Python, Logic Apps ) Solid understanding of MITRE ATT&CK , NCSC CAF , NIST CSF Stakeholder management able to translate technical complexity ...

doing Designing and maintaining the SIEM and XDR platform — data ingestion, log parsing and normalisation, retention, performance Writing and tuning detections in KQL, and building automation to cut manual analyst effort Scripting custom connectors and integrations across the security toolset Leading the technical onboarding of new customers alongside SOC Operations … looking for Around 3–5 years in a Security Operations Centre in an engineering or platform capacity Strong Microsoft Sentinel experience, with confident KQL Hands-on with Microsoft Defender and the wider Microsoft security stack — Intune, Entra ID, Defender for Endpoint Exposure to endpoint tooling such as CrowdStrike, Carbon Black ...