Tenant Rationalisation, SOC Assessment & Detection Lead

Tenant Rationalisation, SOC Assessment & Detection Lead

SC Cleared | Outside IR35 (TBC) | Predominantly Remote

We're supporting a major security transformation programme and are looking for an experienced Tenant Rationalisation, SOC Assessment & Detection Lead to drive the implementation of Microsoft security recommendations across a complex enterprise environment.

This is a hands-on technical leadership role requiring deep expertise in Microsoft Sentinel, detection engineering, and SOC transformation. You'll be responsible for translating assessment outcomes into actionable remediation plans, leading delivery activity, and enhancing detection capabilities across multiple environments.

Key Responsibilities

• Lead delivery of tenant rationalisation and security remediation activities.
• Design, build and optimise Microsoft Sentinel detections and analytics rules.
• Develop and tune KQL queries to improve threat detection coverage.
• Translate SOC assessment findings into a prioritised delivery backlog.
• Coordinate implementation activities across technical teams.
• Validate security improvements and ensure agreed acceptance criteria are met.
• Support testing, stakeholder engagement and delivery governance.

Essential Skills & Experience

• Strong commercial experience with Microsoft Sentinel.
• Advanced KQL development and detection engineering expertise.
• Experience designing, building and tuning analytics rules and use cases.
• Security Operations Centre (SOC) delivery experience.
• Azure security and remediation experience.
• Experience working within complex or multi-tenant environments.
• Proven ability to lead technical delivery whilst remaining hands-on.

Ideal Background

We would particularly like to hear from:

• Microsoft Sentinel Consultants
• Sentinel Technical Leads
• Detection Engineering Leads
• SIEM/SOC Consultants
• Microsoft Security Consultants

Candidates should be able to demonstrate that they have personally built and deployed detections, rather than simply administering or monitoring a Sentinel environment.

Security Requirements

To be considered, candidates must:

• Hold active SC Clearance
• Be a sole British national
• Be willing to attend site when required (potentially up to one day per week)

Contract Details

• Predominantly remote
• Initial engagement until March, with strong likelihood of extension
• Site attendance may occasionally be required
• Immediate interviews available

If you're a hands-on Microsoft Sentinel expert with a strong background in detection engineering and SOC transformation, we'd love to hear from you.