jobapplier

Sr. Cybersecurity Engineering Consultant - SIEM/Microsoft (AIR)

LevelBlue LLC

LevelBlue’s Professional Services Organization is hiring a Senior Cybersecurity Engineering Consultant for client-facing delivery across SIEM engineering, Microsoft security advisory and implementation, and security operations optimization. This is not an analyst role. You will own design and build work on live engagements: analytics, detection logic, security integrations, technical advisory, and client-ready delivery artifacts.

Responsibilities

  • You will run workshops, provide SME-level guidance for technical and non-technical stakeholders, and leave clients with something they can operate.
  • You will operate independently and in mixed teams, manage your own work across concurrent clients, and improve practice proposals and delivery assets.

Engagement Delivery

  • Deliver engagements across a range of service lines. Lead SIEM design and implementation on greenfield SOC builds and brownfield optimization: data-source onboarding (e.g., telemetry analysis, ingestion design, parsing and normalization, custom connectors), analytics rules, hunting queries, automation rules and playbooks, workbooks, incident process alignment, and use-case documentation.
  • Design and build custom detection content aligned to the client’s threat profile and available telemetry.
  • Integrate and operationalize Microsoft Defender XDR.
  • Assess requirements and advise on best-practice implementation and configuration for Microsoft Purview, Entra ID, Defender for Cloud, Azure security, Copilot. Deliver guided implementation and hands-on configuration when required.
  • Microsoft Purview: you can discover client requirements, recommend a target configuration, and explain how to implement it (information protection, DLP, audit, or related controls as relevant). Hands-on build is desirable.
  • Build practical automation where it improves response quality: Sentinel automation rules, Logic Apps, and analyst response actions.
  • Produce client-ready design and build artifacts: for example, use case catalog, automation/playbook designs, implementation plans, gap analyses, tactical maturity roadmaps with executive summaries.
  • Facilitate workshops and discussion sessions; capture requirements, decisions, risks, and scope changes.
  • Support pre-sales with effort estimates, technical scope, and solution shaping.

Requirements

  • Senior consulting or professional-services delivery (not only an internal SOC or engineering seat): you have owned client workshops around business requirements and use case discovery, engagement scope, and signed-off deliverables.
  • Hands-on Microsoft Sentinel engineering in production, including analytic rule design and build, query tuning and optimization, false-positive reduction, and use-case operationalization.
  • Experience producing detection design records (AIR DDRs): our use case notes covering use case scenarios, data sources, KQL, tuning notes.
  • Hands-on Microsoft Defender XDR (at least Defender for Endpoint plus one of Identity / Office / Cloud Apps) in a detection or SOC-integration context.
  • Hands-on Microsoft Purview configuration in a security or compliance context connected to monitoring or control design.

Useful

  • Experience in any of the following is a plus and may be used on engagements; it does not replace SIEM engineering or Microsoft security delivery.
  • Firewall / network security configuration reviews (policy quality, logging to SIEM, segmentation relevant to detections).
  • Active Directory security reviews (beyond detections): privileged access, delegation, hardening, hybrid identity.
  • Azure security reviews (beyond Defender for Cloud / Sentinel): landing-zone and control-plane hygiene.
  • AWS security reviews or multi-cloud posture work.
  • Splunk or SentinelOne (working knowledge).
  • Broader control reviews that feed a security operations or threat detection and response roadmap.
  • Also useful: SC-100, SC-300, SC-400; Splunk ES Admin or Splunk Architect; GIAC detection/IR (e.g. GCIA, GCIH); CISSP

Preferred

  • Certifications (desirable)
  • Most relevant: SC-200; SC-500 (AZ-500)