Sentinel Engineer

About this position: USA | $135k to $155k per annum | Permanent | Remote Reports To: Head: SIEM Engineering On-Call: Participation in a major-incident on-call rotation. Activations are infrequent, typically 3 or 4 times a year, and are reserved for significant security incidents requiring engineering support outside normal hours. Before You Apply: This is a hands-on engineering role. To be considered, you must currently spend 70% or more of your working time in a SIEM engineering role (Sentinel, CrowdStrike). Job Summary Our client is looking for a skilled and experienced Sentinel Engineer to join our cybersecurity team. The role covers both sides of the Sentinel platform: integrating log sources, deploying and enhancing data connectors, developing custom connectors where required, and optimising ingestion, and detection engineering, writing and tuning KQL analytics rules, building hunting queries, and translating threat-actor TTPs into detections that catch real attacks with low false-positive rates. Responsibilities Primary Act as the technical lead for log integration on client onboarding projects — owning the engineering end-to-end, working alongside a project manager who runs the overall programme. Scope log integration workstreams, sequence the work, and track technical progress through delivery. Where there is no project manager in the loop — for example, a new log-source type being driven directly with the client — drive the technical engagement yourself, including pushing client infrastructure teams to open firewall rules, fix GPOs and unblock dependencies. Research, test and advise clients on audit configuration settings for log sources, to ensure that the right logs flow into Sentinel for threat detection. Deploy data connectors and troubleshoot data ingestion, including deployment of Function Apps, customisation and enhancement of Function App code where required, and development of custom log ingestion solutions. Research and prototype integrations for