Role Overview

The Microsoft Sentinel Specialist is accountable for the full lifecycle of Microsoft Sentinel as a cloud-native SIEM and SOAR platform, from architecture and onboarding through to detection engineering, incident response, automation, operational reporting, cost optimisation, and continual service improvement.
The role requires a practitioner who can operate across architecture, engineering and SOC operations. The successful candidate must be able to translate security monitoring requirements into Sentinel workspaces, data connectors, analytics rules, automation rules, Logic Apps playbooks, workbooks, hunting queries, incident workflows and operational processes that can be reused and scaled across multiple customers or business units.

The role covers the end-to-end Sentinel service lifecycle, including:

• Sentinel architecture, workspace design and platform deployment


• Data connector onboarding, log ing...