[Remote] Sr. SIEM Engineering Consultant

Note: The job is a remote job and is open to candidates in USA. ECS is hiring a Senior SIEM Engineering Consultant for its Managed Security Services team. The role designs, deploys, optimizes, and maintains Microsoft Sentinel environments and related integrations, automation, detection, and operational workflows.

Responsibilities

• Design, deploy, and maintain Microsoft Sentinel environments, including Log Analytics Workspaces and data connectors
• Build and optimize data ingestion pipelines, detection rules (analytics), queries (KQL), dashboards (Workbooks), and automation workflows
• Write scripts, automation, and integrations (Python, PowerShell, Bash, etc.) to streamline security operations, data processing, and monitoring
• Deploy and manage Sentinel across cloud environments, primarily Azure, with integrations into AWS, GCP, and hybrid/on-premises environments
• Leverage automation and orchestration tools such as Terraform, Ansible, CI/CD pipelines, and infrastructure-as-code to manage deployments and operational tasks
• Integrate Sentinel with enterprise tools such as Microsoft Defender, identity providers, firewalls, EDR platforms, and other telemetry sources
• Monitor system health, troubleshoot ingestion and performance issues, and optimize for cost, reliability, and scalability
• Develop and tune detection use cases aligned to threat frameworks (e.g., MITRE ATT&CK)
• Configure incident management, alert grouping, and response workflows within Sentinel
• Implement automation and response using playbooks (Logic Apps) for alert enrichment and remediation
• Lead design reviews, provide guidance on SIEM best practices, and support knowledge sharing across teams
• Maintain documentation for architectures, detection logic, deployment patterns, runbooks, and operational best practices
• Stay current with Microsoft security technologies, Sentinel features, and emerging SIEM capabilities

Skills

• Deep, hands-on expertise with Microsoft Sentinel and Azure Monitor (Log Analytics, KQL, data connectors)
• Strong experience with SIEM engineering, including log ingestion, normalization, detection engineering, and incident response workflows
• Proficiency in Kusto Query Language (KQL) for detection development and data analysis
• Strong scripting and automation skills (Python, PowerShell, Bash, etc.)
• Solid understanding of security operations, threat detection, and observability in distributed systems
• Experience designing, deploying, and optimizing production-scale SIEM environments
• Strong knowledge of Azure, cloud security architecture, networking, and identity systems
• Ability to mentor, guide, and influence engineering teams on SIEM and security best practices
• Outstanding verbal and written communication skills
• U.S. Passport required
• Must be eligible to obtain a U.S. Security Clearance
• Willingness and ability to support domestic or international on-site engagements

Benefits

• Remote work

Company Overview