Microsoft Sentinel Engineer - Security Operations

MS Sentinel Engineer Experience: 5 - 8 yrs Location: Chennai/Bangalore/Hyderabad/Coimbatore Key Responsibilities: - Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment, including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks. - Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial triage, investigate suspicious activities, and support incident response and escalation. - Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and detection use cases to reduce false positives and improve threat detection. - Integration with Managed SecOps: Support onboarding and integration of the client's Sentinel environment with the Managed SecOps processes, tools, workflows, and escalation procedures. - Data Connector Management: Validate existing integrations and configure or troubleshoot connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other supported security data sources. - KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat hunting, investigations, detection engineering, and operational reporting. - Transition & Knowledge Transfer: Review existing Sentinel configurations, document current operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent provider wherever access and cooperation are available. - Operational Readiness: Help establish incident handling workflows, escalation matrices, reporting processes, and runbooks for the future co-managed service. - Documentation & Reporting: Maintain technical documentation, incident investigation notes, configuration records, and transition status reports. - Continuous Improvement: Identify gaps in logging, detection coverage, automation, and platform configuration, and recommend remediation actions. Required Technical Skills: - Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions. - Proficiency in KQL for security investigations, threat hunting, and analytics rule development. - Experience configuring and troubleshooting Sentinel data connectors and log ingestion. - Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft 365 security telemetry. - Experience with SIEM operations, security incident investigation, alert triage, and escalation. - Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat hunting. - Experience with Sentinel automation rules, playbooks, and Logic Apps. - Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control. - Strong troubleshooting, documentation, communication, and stakeholder management skills. Preferred Qualifications: - Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience. - Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps environment. - Experience with SIEM transitions, security platform onboarding, and co-managed SOC operating models. - Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code practices. Expected Deliverables: - 1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage. - 2. Maintain continuity of Sentinel platform support and agreed security monitoring activities. - 3. Identify and address critical gaps in data ingestion, detection rules, and incident handling. - 4. Integrate the client environment into the Managed SecOps workflows and escalation processes. - 5. Document the existing configuration, operational procedures, and outstanding risks. - 6. Support service transition, knowledge transfer, and readiness for the future co-managed Sentinel model.