SIEM Content and Platform Engineer

“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant About CyberOne CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio—across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance. Job Title: SIEM Content and Platform Engineer Location: Hybrid ; 1 day per month reporting in London office Employment Type: Full Time Purpose of Role We are seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. The role combines SIEM platform engineering, detection content development, security engineering, automation, and operational support to improve enterprise monitoring and cyber resilience. The engineer will work with Security Operations, Infrastructure, Cloud, and Application teams to deliver scalable telemetry, high-fidelity detections, secure integrations, and continuous improvement of the Proactive Security monitoring capability. Main Duties and Responsibilities Act as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns, use-case documentation, and governance for the detection engineering lifecycle. Design and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python. Perform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation, and security control validation. Support integration and engineering of endpoint, identity, cloud, network, and infrastructure security controls with the SIEM and Defender ecosystem. Build Sentinel Workbooks, dashboards, platform health monitoring, and KPI/KRI reporting for the Proactive Security function. Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures, and support documentation. Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting, and technical support during critical incidents and major changes. Specification Essential Experience Proven experience in SIEM, detection, or security platform engineering within a large enterprise environment. …