OT SIEM Engineer

Sword Group

. Onboard and integrate log sources into Microsoft Sentinel across enterprise and Operational Technology environments .

Posted 10/15/2026full-timeGlasgow • United KingdomMid-LevelSenior💰 £75,000 - £80,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in SIEM engineering and security monitoring, with a strong focus on integrating log sources, developing Kusto Query Language queries, and implementing automation workflows. Proficient in collaborating with security teams to enhance threat detection and incident response capabilities in complex environments.

Highest-signal resume keywords

SIEM EngineeringKusto Query Language (KQL)Automation TechnologiesMicrosoft SentinelCI/CD Pipelines

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Log ParsingData NormalisationEvent CorrelationThreat DetectionSecurity Use Case DevelopmentAlert TuningIncident ResponseThreat HuntingSecurity AutomationOrchestration

Soft Skills

Analytical SkillsProblem-Solving SkillsCommunication SkillsCollaboration SkillsIndependent Work

Tools & Technologies

Microsoft SentinelLogic AppsPlaybooksAzure DevOpsGitLogRhythmSplunkQRadarArcSightElastic

Certifications & Qualifications

Current Security Check (SC) Clearance

Industry Keywords

Operational TechnologyCritical National InfrastructureUtilitiesEnergy EnvironmentsNISTMITRE ATT&CKCyber Essentials

Tech Stack

Tools & technologies

AzureCloudSplunk

About the role

Key responsibilities & impact

Onboard and integrate log sources into Microsoft Sentinel across enterprise and Operational Technology environments
Develop and maintain custom parsers, data transformations and normalisation processes
Design, develop and optimise Kusto Query Language queries for security monitoring and threat detection
Create, tune and maintain analytics rules, alerts and detection logic
Develop and support Logic Apps, Playbooks and SOAR automation workflows
Support migration and integration of security telemetry from LogRhythm and other SIEM platforms into Microsoft Sentinel
Implement and maintain CI/CD pipelines using Azure DevOps and Git
Automate deployment, configuration and ongoing management of Sentinel content and integrations
Collaborate with Cyber Defence and Security Operations teams on monitoring, threat detection and incident response
Contribute to threat hunting, detection engineering and continuous improvement
Apply security engineering best practice in complex, highly regulated environments

Requirements

What you’ll need

Proven hands-on experience in SIEM engineering, administration or security monitoring environments
Experience onboarding log sources and integrating security telemetry into enterprise SIEM platforms
Strong understanding of log parsing, data normalisation and event correlation
Experience developing and optimising queries using KQL or equivalent SIEM query languages
Knowledge of threat detection, security use case development and alert tuning
Understanding of security monitoring, incident response and threat hunting activities
Experience with automation technologies such as Logic Apps, Playbooks or equivalent SOAR platforms
Familiarity with source control and CI/CD tools such as Git and Azure DevOps
Strong analytical and problem-solving skills
Ability to troubleshoot complex technical issues
Ability to work independently while collaborating effectively with technical teams and customer stakeholders
Strong communication skills and ability to translate technical requirements into practical engineering solutions
Hands-on experience engineering and administering Microsoft Sentinel (preferred)
Experience with LogRhythm, Splunk, QRadar, ArcSight or Elastic (preferred)
Experience implementing security automation and orchestration capabilities (preferred)
Knowledge of Microsoft Azure security services and cloud-native security monitoring (preferred)
Experience in Operational Technology, Critical National Infrastructure, utilities or energy environments (preferred)
Understanding of NIST, MITRE ATT&CK and Cyber Essentials (preferred)
Experience supporting SIEM migration or transformation programmes (preferred)
Current Security Check (SC) clearance or eligibility to obtain clearance (preferred)

Benefits

Comp & perks

Personalised Career Development with customised development plans and learning and development opportunities
Flexible working arrangements
Generous annual leave allowance
Enhanced family friendly benefits
Pension scheme
Access to private health, well-being, and insurance schemes
Inclusive and equal opportunities workplace
Support with accessibility adjustments during the hiring process