Remote L3 SOC Analyst - Microsoft XDR/Sentinel

- Lead and manage high-severity security incidents from identification through containment, eradication, recovery, and post-incident reporting - Perform advanced threat hunting using Microsoft Defender XDR, Sentinel, KQL, and other telemetry sources to identify emerging threats, anomalous behaviour, and undetected malicious activity - Develop, tune, and maintain Sentinel analytics rules, workbooks, playbooks (Logic Apps), and custom detection use cases to improve SOC detection capability - Act as a subject matter expert for the Microsoft security ecosystem, including Defender for Endpoint, Office 365, Identity, Cloud Apps, Defender for Cloud, and Azure security controls - Create and maintain Kusto Query Language (KQL) queries, automation workflows, and enrichment logic to enhance detections and investigation efficiency - Support purple-team activities, threat modelling, and attack-simulation scenarios aligned to MITRE ATT&CK - Provide technical escalation support and mentorship to L1/L2 SOC analysts - Perform root-cause analysis, identify systemic issues, and drive continuous improvement across SOC processes - Collaborate with engineering, cloud, and cybersecurity teams to enhance log ingestion, telemetry quality, and SIEM/SOAR architecture - Produce clear, structured incident reports, threat briefs, and stakeholder updates