Senior InfoSec Engineer

Job Summary

We are looking for an InfoSec Engineer handling SOC deliverables and supporting other InfoSec services. The role partners with engineering, architecture, DevOps, cloud and security teams to identify risks early, automate security controls, and help teams build secure products at scale. The ideal candidate combines hands-on AppSec skills with strong software engineering awareness and can translate security findings into practical remediation guidance.

Responsibilities

Microsoft Sentinel SOC Operations

• Support second level of escalation to outsourced Managed Services SOC who are responislb eofr monitoring, triage and investigate alerts and incidents generated by Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, Azure security services and other integrated security technologies.
• Own incidents through validation, prioritization, escalation, containment support, resolution and closure, maintaining clear investigation records and evidence.
• Improve Microsoft Sentinel analytic rules, automation rules, playbooks, workbooks, watchlists and monitoring coverage.
• Monitor data connector and log-ingestion health, identify visibility gaps and coordinate restoration with relevant support teams.
• Work effectively with managed SOC providers and internal teams to ensure timely, high-quality investigation and response.

Threat Hunting Detection Engineering

• Conduct proactive threat hunts across identity, endpoint, cloud, network and application telemetry using Kusto Query Language (KQL).
• Develop and refine hypotheses, identify suspicious patterns, validate indicators of compromise and document hunt outcomes.
• Tune detections to improve fidelity, reduce avoidable noise and expand coverage for priority threats and attack techniques.
• Use threat intelligence to assess emerging campaigns, exposed credentials, malicious infrastructure and look-alike domains.

Incident Response

• Investigate phishing, malware, credential compromise, suspicious authentication, data exposure and other cyber security events.
• Support incident containment, eradication and recovery activities in coordination with technical and business stakeholders.
• Contribute to root-cause analysis, lessons learned, incident reports, response playbooks and operational runbooks.
• Participate in incident response exercises and help improve organisational readiness.

Broader Global InfoSec Services

• Support vulnerability management by assessing findings, validating exposure, helping prioritise risk and coordinating remediation with technology teams.
• Contribute to internal and external security audits, evidence collection, control validation and remediation tracking.
• Support security assessments, third-party reviews, risk-reduction initiatives, security advisories and operational process improvements.
• Produce meaningful SOC, incident, detection and vulnerability metrics for technical and management audiences.

Skills Required

• 5+ years of experience in a Security Operations Centre, cyber incident response or a closely related security operations role.
• Hands-on experience investigating incidents in Microsoft Sentinel and Microsoft Defender XDR.
• Practical knowledge of Microsoft Entra ID, Azure security telemetry and endpoint security investigations.
• Strong KQL skills for investigation, hunting, dashboards and detection development.
• Experience with threat hunting, incident response, threat intelligence and SIEM operations.
• Working knowledge of vulnerability management processes and collaboration with remediation owners.
• Ability to analyse complex events, make sound risk-based decisions and communicate clearly with technical and non-technical stakeholders.
• Experience collaborating across geographies and with managed security service providers.

Desirable qualifications

• Relevant certifications are valued but are not a substitute for strong practical experience. Examples include:
• B.E./B.Tech./M.E./M.Tech in (CS/IT/Eex. Comms.)

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.