{"id":2521740,"url":"https://alion.io/job/sword-group-ot-siem-engineer","title":"OT SIEM Engineer","company":{"id":54648,"name":"Sword Group","domain":"sword-group.com","url":"https://alion.io/company/sword-group","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":94,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":33,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Glasgow, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":52000,"max_usd":118000,"period":"year","method":"role_country_seniority_unknown","sample_n":140},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"Git","optional":false},{"name":"IBM QRadar","optional":false},{"name":"LogRhythm","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-14T11:14:43Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-15T16:56:23Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"At Sword, we help power, secure and transform the organisations that keep the UK running. Supporting customers across Critical National Infrastructure, energy, public sector and enterprise markets, we combine deep industry expertise with leading technology services spanning managed services, cyber security, cloud, data, AI and digital transformation.\nJoin Sword and you'll be part of a team solving complex challenges, delivering real-world impact and working alongside talented colleagues who care deeply about quality, collaboration and customer success.\nAbout the Role:\nAs an OT SIEM Engineer, you will play a key role in strengthening cyber security monitoring and threat detection capabilities across complex enterprise and Operational Technology (OT) environments, with a particular focus on Microsoft Sentinel.\nThis is a hands-on engineering role where you will support the development and enhancement of SIEM capabilities, integrating security telemetry, developing detection content and implementing automation to improve security operations. You'll work closely with Cyber Defence and Security Operations teams, helping to deliver effective monitoring and threat detection solutions within Critical National Infrastructure.\nYou'll also support the migration and integration of log data from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel, contributing to the ongoing development of a modern, scalable security monitoring capability.\nYou'll be joining at an exciting time as we continue to grow our cyber security capabilities and deliver increasingly complex solutions for our customers. Sword was recently named Splunk 2026 EMEA Services Partner of the Year for Outstanding Regional Partnership in the AI-Driven Era, recognising the strength of our technical expertise, customer partnerships and the work being delivered across our practice. It's a great opportunity to become part of that continued growth while helping protect the systems and infrastructure that deliver essential services.\nAs an OT SIEM Engineer, you will:\nOnboard and integrate log sources into Microsoft Sentinel across enterprise and Operational Technology environments.\nDevelop and maintain custom parsers, data transformations and normalisation processes to improve the quality and consistency of security telemetry.\nDesign, develop and optimise Kusto Query Language (KQL) queries to support security monitoring and threat detection.\nCreate, tune and maintain analytics rules, alerts and detection logic to strengthen security monitoring capabilities.\nDevelop and support Logic Apps, Playbooks and SOAR automation workflows to improve the efficiency of security operations.\nSupport the migration and integration of security telemetry from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel.\nImplement and maintain CI/CD pipelines using Azure DevOps and Git to support the deployment and management of SIEM content.\nAutomate the deployment, configuration and ongoing management of Sentinel content and integrations.\nWork closely with Cyber Defence and Security Operations teams to enhance monitoring, threat detection and incident response capabilities.\nContribute to threat hunting, detection engineering and continuous improvement activities.\nApply security engineering best practice within complex, highly regulated environments.\nRequirements\nProven hands-on experience in SIEM engineering, administration or security monitoring environments.\nExperience onboarding log sources and integrating security telemetry into enterprise SIEM platforms.\nStrong understanding of log parsing, data normalisation and event correlation.\nExperience developing and optimising queries using KQL or equivalent SIEM query languages.\nKnowledge of threat detection, security use case development and alert tuning.\nUnderstanding of security monitoring, incident response and threat hunting activities.\nExperience working with automation technologies such as Logic Apps, Playbooks or equivalent SOAR platforms.\nFamiliarity with source control and CI/CD tools such as Git and Azure DevOps.\nStrong analytical and problem-solving skills, with the ability to troubleshoot complex technical issues.\nAbility to work independently while collaborating effectively with technical teams and customer stakeholders.\nStrong communication skills and the ability to translate technical requirements into practical engineering solutions.\nIt would be great if you also had:\nHands-on experience engineering and administering Microsoft Sentinel.\nExperience with LogRhythm or other enterprise SIEM technologies such as Splunk, QRadar, ArcSight or Elastic.\nExperience implementing security automation and orchestration capabilities.\nKnowledge of Microsoft Azure security services and cloud-native security monitoring.\nExperience working within Operational Technology (OT), Critical National Infrastructure, utilities or energy environments.\nUnderstanding of security frameworks including NIST, MITRE ATT&CK and Cyber Essentials.\nExperience supporting SIEM migration or transformation programmes.\nCurrent Security Check (SC) clearance or eligibility to obtain clearance.\nBenefits\nAt Sword, our core values and culture are based on caring about our people, investing in training and career development, and building inclusive teams where we are all encouraged to contribute to achieve success. We offer comprehensive benefits designed to support your professional development and enhance your overall quality of life. Here's what you can expect as part of our benefits package:\nPersonalised Career Development: We create a development plan customised to your goals and aspirations, with a range of learning and development opportunities within a culture that encourages growth.\nFlexible working: Flexible work arrangements to support your work-life balance. We can’t promise to always be able to meet every request, however, are keen to discuss your individual preferences to make it work where we can.\nA Fantastic Benefits Package: This includes generous annual leave allowance, enhanced family friendly benefits, pension scheme, access to private health, well-being, and insurance schemes.\nAt Sword we are dedicated to fostering a diverse and inclusive workplace and are proud to be an equal opportunities employer, ensuring that all applicants receive fair and equal consideration for employment, regardless of whether they meet every requirement. If you don’t tick all the boxes but feel you have some of the relevant skills and experience we’re looking for, please do consider applying and highlight your transferable skills and experience. We embrace diversity in all its forms, valuing individuals regardless of age, disability, gender identity or reassignment, marital or civil partner status, pregnancy or maternity status, race, colour, nationality, ethnic or national origin, religion or belief, sex, or sexual orientation. Your perspective and potential are important to us.\nIf we can do anything to help make the hiring process more accessible, please let our talent acquisition team know when you apply so we can support any adjustments.","description_format":"text","description_chars":7137,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Flexible schedule","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-14T11:14:43Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":33,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/sword-group-ot-siem-engineer","json_url":"https://alion.io/job/sword-group-ot-siem-engineer.json","meta":{"generated_at":"2026-10-15T17:08:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25945,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":54648},"rest":"https://alion.io/mcp/rest/get_company?id=54648"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsword-group-ot-siem-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsword-group-ot-siem-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsword-group-ot-siem-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sword-group-ot-siem-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsword-group-ot-siem-engineer"}]}