{"id":1774511,"url":"https://alion.io/job/cyberone-siem-content-and-platform-engineer","title":"SIEM Content and Platform Engineer","company":{"id":695879,"name":"CyberOne","domain":"cyberone.security","url":"https://alion.io/company/cyber-one","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"A","score":85,"open_postings":12,"ghost_share":0,"stale_share":0.583,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-12T06:55:09Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":65000,"max_usd":151000,"period":"year","method":"role_country_seniority_unknown","sample_n":132},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"Copilot","optional":false},{"name":"Git","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Sysmon","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-02T09:45:43Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-12T09:16:20Z","board_verified":true,"closed_at":null,"days_open":10,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":10},"description":"“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant\nAbout CyberOne\nCyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.\nJob Title: SIEM Content and Platform Engineer\nLocation: Hybrid; 1 day per month reporting in London office\nEmployment Type: Full Time\nPurpose of Role\nWe are seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team. The role combines SIEM platform engineering, detection content development, security engineering, automation, and operational support to improve enterprise monitoring and cyber resilience.\nThe engineer will work with Security Operations, Infrastructure, Cloud, and Application teams to deliver scalable telemetry, high-fidelity detections, secure integrations, and continuous improvement of the Proactive Security monitoring capability.\nMain Duties and Responsibilities\nAct as a Subject Matter Expert for Microsoft Sentinel, detection engineering, security monitoring architecture, and associated security platforms.\n\nDesign, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK.\n\nEngineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations.\n\nDevelop logging standards, onboarding patterns, use-case documentation, and governance for the detection engineering lifecycle.\n\nDesign and implement automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python.\n\nPerform security engineering activities including secure solution design, technical risk assessment, platform hardening, vulnerability remediation, and security control validation.\n\nSupport integration and engineering of endpoint, identity, cloud, network, and infrastructure security controls with the SIEM and Defender ecosystem.\n\nBuild Sentinel Workbooks, dashboards, platform health monitoring, and KPI/KRI reporting for the Proactive Security function.\n\nProduce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures, and support documentation.\n\nLead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting, and technical support during critical incidents and major changes.\n\nSpecification\nEssential Experience\nProven experience in SIEM, detection, or security platform engineering within a large enterprise environment.\n\nStrong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity, and Cloud.\n\nExperience developing and tuning high-fidelity detections, threat-hunting queries, cross-data correlation, and contextual enrichment.\n\nExperience onboarding infrastructure, cloud, application, and security telemetry into a SIEM.\n\nPractical experience with security architecture, platform hardening, vulnerability remediation, technical risk assessment, and security control validation.\n\nExperience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting, and operational support.\n\nExperience applying Detection-as-Code, CI/CD, source control, and peer-review practices.\n\nTechnical Knowledge and Skills\nAdvanced Microsoft Sentinel administration, architecture, KQL, analytics rules, hunting, workbooks, watchlists, playbooks, and optimisation.\n\nAzure Monitor Agent, Azure Arc, Data Collection Rules, Log Analytics, custom tables, parsers, and custom ingestion.\n\nWindows Event Forwarding and Collection, XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging.\n\nAzure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation.\n\nMITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management.\n\nSecurity engineering across endpoint, identity, cloud, network, and hybrid infrastructure controls.\n\nAzure DevOps or equivalent Git-based CI/CD, Infrastructure-as-Code concepts, secure development practices, and tools such as Cribl.\n\nQualifications\nDegree or equivalent professional experience in Information Technology, Cyber Security, Engineering, or a related discipline.\n\nRelevant Microsoft certifications such as SC-200 or AZ-500 are desirable.\n\nAdditional cloud, SIEM, security engineering, or automation certifications are advantageous.\n\nKey Behaviours and Competencies\nProactive, accountable, and delivery-focused approach.\n\nStrong analytical, troubleshooting, and problem-solving capability.\n\nClear communication with technical, operational, and management stakeholders.\n\nEffective collaboration across teams, regions, and technical disciplines.\n\nCalm, structured delivery under pressure, with disciplined documentation and prioritisation.\n\nWillingness to provide planned out-of-hours support for critical upgrades and major changes when required.\n\nWhy Join Us?\nWork with cutting-edge Azure technologies and drive cloud transformation projects.\n\nBe part of a dynamic team that values innovation, collaboration, and technical excellence.\n\nCompetitive compensation, career growth opportunities, and access to continuous learning and certifications.\n\nOpportunity to work on impactful cloud initiatives across various industries.\n\nWhy CyberOne:\nElite positioning: Microsoft Security Partner, CREST & NCSC-certified\n\nAccess to cutting-edge MXDR platform & proprietary SecOps tools\n\nNo glass ceilings: rapid growth, fast-track leadership opportunities\n\nCulture-first: bold values, open feedback, and relentless innovation\n\nLet’s redefine what it means to be secure. Together.\n#CyberDefenders","description_format":"text","description_chars":6055,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Growth opportunities"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-03T16:10:23Z"}],"visa":[],"liveness":{"score":56,"band":"ok","label":"Likely open","p_open":1,"p_active":0.56,"p_room":1,"age_days":9,"expected_fill_days":33,"reasons":["conf:4","stale_co","velocity","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/cyberone-siem-content-and-platform-engineer","json_url":"https://alion.io/job/cyberone-siem-content-and-platform-engineer.json","meta":{"generated_at":"2026-10-12T14:24:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22653,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":695879},"rest":"https://alion.io/mcp/rest/get_company?id=695879"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyberone-siem-content-and-platform-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyberone-siem-content-and-platform-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyberone-siem-content-and-platform-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyberone-siem-content-and-platform-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyberone-siem-content-and-platform-engineer"}]}