Responsibilities: SIEM Management
- Deploy, configure, and maintain Microsoft Sentinel SIEM solution.
- Integrate various log sources (cloud, on-prem, network, endpoints) into Sentinel.
- Ensure data connectors and ingestion pipelines are optimized for performance and cost.
Security Monitoring & Analysis
- Develop and maintain detection rules, analytics, and use cases in Sentinel.
- Monitor alerts and dashboards for suspicious activities and anomalies.
- Collaborate with SOC analysts for incident triage and investigation.
Automation & Optimization
- Implement automation using Logic Apps and Playbooks for alert enrichment and response.
- Optimize Sentinel workbooks, hunting queries, and dashboards for better visibility.
Compliance & Reporting
- Generate compliance and security posture reports using Sentinel workbooks.
- Ensure adherence to regulatory requirements (ISO, GDPR, etc.) through proper logging and monitoring.
Threat Hunting & Incident Response
- Conduct proactive threat hunting using KQL (Kusto Query Language) .
- Assist in forensic analysis and root cause investigations.
Maintenance & Upgrades
- Apply patches, updates, and maintain Sentinel health.
- Monitor ingestion costs and optimize retention policies.
