Security Engineer - SIEM

- Design, implement, and maintain Microsoft Sentinel workspaces, connectors, analytics rules, and playbooks - Develop advanced KQL queries for threat hunting and reporting - Optimize SIEM performance, cost, and data retention policies - Troubleshoot log ingestion and parsing issues - Onboard and configure critical log sources (AD, firewalls, servers, cloud infrastructure) - Manage event collection and forwarding infrastructure - Implement data filtering and custom log parsing - Develop and refine detection rules based on threat intelligence and attack patterns - Continuously improve detection efficacy and reduce false positives - Monitor systems for anomalies and malicious activity - Contribute to threat hunting and incident response playbooks - Provide expert guidance on securing applications and infrastructure - Support PoCs for new security tools - Help define and measure control effectiveness.