OT SIEM Engineer
Core
Strengthen cyber security monitoring and threat detection capabilities across complex enterprise and Operational Technology (OT) environments, with a focus on Microsoft Sentinel.
Role type
OT SIEM Engineer
Builds
Modern, scalable security monitoring capability integrating security telemetry and automation.
Domain
Cyber security, Operational Technology (OT), Critical National Infrastructure
Required skills
SIEM engineering, log source onboarding, log parsing, data normalisation, Kusto Query Language (KQL), threat detection, SOAR automation, CI/CD pipelines, Azure DevOps, Git
Preferred skills
Microsoft Sentinel administration, LogRhythm/Splunk experience, security automation, Microsoft Azure security services, OT/energy environment experience, NIST/MITRE ATT&CK frameworks, Security Check (SC) clearance
Technologies
Microsoft Sentinel, LogRhythm, KQL, Logic Apps, Azure DevOps, Git, Microsoft Azure
Responsibilities
Onboard and integrate log sources into Microsoft Sentinel; Develop and maintain custom parsers and data transformations; Design and optimise KQL queries; Create and tune analytics rules and detection logic; Develop and support SOAR automation workflows; Support migration of log data from existing SIEM platforms; Implement and maintain CI/CD pipelines; Contribute to threat hunting and detection engineering.
Seniority
Mid-Senior, hands-on IC
