Cyber Monitoring Platform Engineer

About the role

The Cyber Monitoring Platform Engineer designs, implements, operates, and continuously improves the organization’s cyber monitoring platforms, focusing on Microsoft security technologies. The role ensures that detection, investigation, and response capabilities are scalable, reliable, and aligned with the evolving threat landscape and SOC needs.

Key responsibilities

• Design, deploy, and operate monitoring platforms built on Microsoft Sentinel and Microsoft Defender XDR.
• Maintain high availability, performance, and resilience across production and pre‑production environments.
• Administer platform access using Azure AD/Entra ID, RBAC, and privileged access controls.
• Manage lifecycle activities such as upgrades, patching, configuration changes, and capacity planning.
• Onboard and maintain log sources from on‑prem, Azure, M365, SaaS, and third‑party tools, optimizing ingestion pipelines and data retention.
• Implement Infrastructure‑as‑Code with Terraform, ARM/Bicep, and Git‑based CI/CD pipelines to automate deployment of Sentinel, Defender, analytics rules, playbooks, and Logic Apps.
• Collaborate with SOC analysts, detection engineers, threat hunters, and incident response teams to ensure platform capabilities meet operational requirements.
• Leverage Microsoft Security Copilot to enhance investigation efficiency and operational insights.

Required profile

• Strong background in security operations and platform engineering.
• Experience working within a SOC or cyber defense environment.
• Ability to collaborate with analysts, detection engineers, and incident responders.
• Commitment to continuous improvement and automation of security workflows.

Required skills

• Microsoft Sentinel (SIEM & SOAR)
• Microsoft Defender XDR
• Microsoft Security Copilot
• Azure AD / Entra ID and RBAC
• Terraform, ARM templates, Bicep
• Git and CI/CD pipelines
• Logic Apps for automation
• Log ingestion, normalization, and correlation across cloud and on‑prem environments