Senior Information Security Engineer

Help lead enterprise SIEM engineering and cloud security enablement in a Wilmington, DE onsite role.

Responsibilities

• Lead engineering, deployment, administration, and continuous enhancement of Microsoft Sentinel as the organization’s enterprise SIEM platform (workspace architecture, RBAC, retention management, ingestion cost optimization).
• Design, build, maintain, and troubleshoot security data ingestion pipelines and Sentinel connectors using Azure Monitor Agent, Data Collection Rules, CEF/Syslog, APIs, Event Hubs, Azure Functions, Logic Apps, and custom integration patterns.
• Validate and troubleshoot ingested data using KQL and other tools; address data quality, schema, parsing, normalization, latency, performance, and ingestion reliability issues.
• Engineer and support log routing, filtering, parsing, and transformation through Cribl, including upstream ingestion issue troubleshooting and onboarding new data sources into Sentinel.
• Establish scalable, supportable patterns for onboarding security telemetry from on-premises, cloud, SaaS, and third-party platforms, with automated monitoring and validation of ingestion pipelines.
• Apply engineering best practices across Sentinel configurations and content, including source control, testing, peer review, CI/CD deployment, technical documentation, and lifecycle management.
• Identify repeatable manual tasks across security engineering platforms and develop automation to reduce operational effort and improve consistency and response times.
• Design, build, and maintain security automation and orchestration using Sentinel Automation Rules, Logic Apps, Azure Functions, PowerShell, Python, REST APIs, and Infrastructure as Code (Bicep, ARM, Terraform).
• Develop and maintain detection-as-code and automation-as-code practices by integrating security content deployment into CI/CD pipelines and measuring outcomes such as operational efficiency and time savings.
• Design, implement, and maintain Azure security controls and security architecture standards, including Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, and secure landing zone architectures.
• Translate business, regulatory, and security requirements into technical controls, monitoring requirements, and security baselines across Azure, hybrid, and on-premises environments.
• Provide technical guidance and hands-on support to infrastructure, cloud, and application teams on secure architecture patterns, cloud security best practices, and risk mitigation strategies.
• Design, implement, and maintain Microsoft Purview data protection capabilities (DLP, sensitivity labels, information protection, Insider Risk Management, and auditing solutions).
• Prepare and maintain technical standards, procedures, security documentation, runbooks, and operational guidance for Sentinel, cloud security, automation, and data protection capabilities.
• Monitor emerging threats and industry trends, translating findings into new detections, automation opportunities, and security control improvements.
• Prepare and present project status, risks, and security initiatives to leadership with actionable recommendations and clear communication of technical concepts.
• Lead and mentor junior security engineers through design reviews, technical guidance, knowledge sharing, and career development support.
• Provide Person in Charge (PIC) coverage on a rotational basis as the senior escalation point for complex security incidents and operational decisions.
• Collaborate with Security Operations, Infrastructure, Cloud, DevOps, and IT teams to design, implement, and continuously improve security controls, monitoring capabilities, automation solutions, and data protection across the enterprise.

Requirements

• 5+ years’ experience as a Cloud Security Engineer, Information Security Engineer, or Devsecops Engineer.
• 5+ years’ experience in network, cloud, and computer system security, including user access controls, RBAC, SSO, file permissions, firewall policies, and audit logs.
• 5+ years’ experience with security systems: firewalls, intrusion detection systems, endpoint protection systems, web application firewalls, vulnerability scanning software, privilege access management, data loss protection, log management, and content filtering.
• 5+ years’ experience developing and deploying security solutions to defend against advanced cyber threats.
• 5+ years’ experience reviewing and monitoring security systems to ensure proper and secure operation.
• 5+ years’ experience investigating intrusion incidents, conducting investigations, and handling security incidents.

Technologies

• Microsoft Sentinel, Azure Monitor Agent, Data Collection Rules
• CEF/Syslog, APIs, Event Hubs
• Azure Functions, Logic Apps, Azure Monitor
• KQL, Cribl, Sentinel connectors
• Sentinel Automation Rules, PowerShell, Python, REST APIs
• Infrastructure as Code (Bicep, ARM, Terraform), CI/CD
• Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault
• Secure landing zone architectures
• Microsoft Purview, Data Loss Prevention (DLP), sensitivity labels, Insider Risk Management
• Log management, SSO, RBAC, SaaS, on-premises

Location

• Wilmington, DE (onsite)

Sponsorship

• Sponsorship not offered for this role

We do not accept unsolicited resumes from third party recruiting agencies or firms.