Microsoft Sentinel Engineer - Security Operations - Cybersecurity
First seen by Alion on Oct 26, 2026.
MS Sentinel Engineer
Experience: 5 - 8 yrs
Location: Chennai/Bangalore/Hyderabad/Coimbatore
Key Responsibilities:
- Microsoft Sentinel Administration: Manage and maintain the Microsoft Sentinel environment, including workspaces, data connectors, analytics rules, incidents, automation rules, and workbooks.
- Security Monitoring & Incident Support: Monitor Sentinel incidents and alerts, perform initial triage, investigate suspicious activities, and support incident response and escalation.
- Detection Engineering: Review, tune, and optimize analytics rules, correlation logic, and detection use cases to reduce false positives and improve threat detection.
- Integration with Managed SecOps: Support onboarding and integration of the client's Sentinel environment with the Managed SecOps processes, tools, workflows, and escalation procedures.
- Data Connector Management: Validate existing integrations and configure or troubleshoot connectors for Microsoft Defender, Microsoft Entra ID, Microsoft 365, Azure resources, and other supported security data sources.
- KQL Development: Develop and optimize Kusto Query Language (KQL) queries for threat hunting, investigations, detection engineering, and operational reporting.
- Transition & Knowledge Transfer: Review existing Sentinel configurations, document current operating procedures, identify coverage gaps, and support knowledge transfer from the incumbent provider wherever access and cooperation are available.
- Operational Readiness: Help establish incident handling workflows, escalation matrices, reporting processes, and runbooks for the future co-managed service.
- Documentation & Reporting: Maintain technical documentation, incident investigation notes, configuration records, and transition status reports.
- Continuous Improvement: Identify gaps in logging, detection coverage, automation, and platform configuration, and recommend remediation actions.
Required Technical Skills:
- Strong hands-on experience with Microsoft Sentinel and Microsoft security solutions.
- Proficiency in KQL for security investigations, threat hunting, and analytics rule development.
- Experience configuring and troubleshooting Sentinel data connectors and log ingestion.
- Knowledge of Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft 365 security telemetry.
- Experience with SIEM operations, security incident investigation, alert triage, and escalation.
- Understanding of MITRE ATT&CK, security use cases, detection engineering, and threat hunting.
- Experience with Sentinel automation rules, playbooks, and Logic Apps.
- Familiarity with Azure Monitor, Log Analytics workspaces, and role-based access control.
- Strong troubleshooting, documentation, communication, and stakeholder management skills.
Preferred Qualifications:
- Microsoft Certified: Security Operations Analyst Associate (SC-200) or equivalent experience.
- Experience supporting enterprise customers in an MDR, MSSP, or Managed SecOps environment.
- Experience with SIEM transitions, security platform onboarding, and co-managed SOC operating models.
- Exposure to Sentinel content management using Git, Azure DevOps, or infrastructure-as-code practices.
Expected Deliverables:
- 1. Assess the existing Sentinel configuration, integrations, alerting, and operational coverage.
- 2. Maintain continuity of Sentinel platform support and agreed security monitoring activities.
- 3. Identify and address critical gaps in data ingestion, detection rules, and incident handling.
- 4. Integrate the client environment into the Managed SecOps workflows and escalation processes.
- 5. Document the existing configuration, operational procedures, and outstanding risks.
- 6. Support service transition, knowledge transfer, and readiness for the future co-managed Sentinel model.
Skills
KQL, SIEM, Microsoft Defender, Security Operations Center, Sentinel, Logic App