Senior Microsoft Sentinel SIEM Engineer

HCLTech is a global technology company, home to more than 226,000+ people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending December 2025 totaled $14.5 billion. At HCLTech, you’ll supercharge your potential. You’ll find your career. And you’ll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first.

Job Summary:

We are looking for an experienced Microsoft Sentinel SIEM Engineer to support a leading European financial institution. This is a hands-on engineering role focused on the build, configuration, integration, optimization, and ongoing health of the Microsoft Sentinel environment, including data source onboarding, ingestion management, platform performance, automation, and SIEM integrations. The position is primarily focused on SIEM infrastructure and engineering rather than day-to-day SOC analysis and incident response**.**

The role operates within a 7:00 AM – 7:00 PM CET coverage window, with working shifts scheduled within this timeframe. Participation in an on-call rotation is also required.

Key responsibilities:

• Identify critical applications and telemetry sources for SIEM onboarding.
• Optimize Microsoft Sentinel ingestion and cost drivers while preserving detection value.
• Develop or tune threat analytics and detection use cases.
• Plan automation, sandboxing and SOAR workflows with ServiceNow integration touchpoints.
• Support breach attack simulation POC and triage process improvement.
• Design, implement, and continuously improve security monitoring and threat detection capabilities across the organization.
• Onboarding, configuration, and optimization of Microsoft Sentinel and other SIEM platforms.
• Develop and maintain detection rules, use cases, alerts, dashboards, and security monitoring processes.
• Build and enhance SOAR playbooks to automate repetitive security operations and incident response activities.
• Perform threat hunting, incident investigations, and root cause analysis to identify and address security threats.
• Integrate security tools, cloud platforms, endpoints, and network devices into the SIEM ecosystem.
• Work closely with SOC analysts, security teams, and technology stakeholders to improve visibility, detection coverage, and response effectiveness.
• Provide recommendations to strengthen the organization’s overall security posture and monitoring maturity.

Required skills and experience:

• Minimum 4 years of relevant experience in SIEM Engineering, Security Engineering, Security Operations, or Cyber Security, with hands-on experience in Microsoft Sentinel.
• Detection engineering and analytics tuning
• SOAR playbooks and automation
• Threat simulation and sandboxing
• SOC process and incident workflow integration
• Experience in Security Operations, SIEM Engineering, Threat Detection, or Cyber Security Monitoring.
• Strong hands-on experience with Microsoft Sentinel, including log onboarding, analytics rules, workbooks, hunting queries, and incident management.
• Experience working with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, ArcSight, or similar solutions.
• Good understanding of security operations, security monitoring, incident response, and threat hunting practices.
• Experience developing and tuning detection use cases to reduce false positives and improve threat visibility.
• Hands-on experience with SOAR platforms and security automation workflows.
• Strong knowledge of log analysis, event correlation, and security investigations across cloud, endpoint, identity, and network environments.
• Familiarity with the MITRE ATT&CK Framework, threat intelligence integration, and detection engineering concepts.
• Experience with Microsoft security technologies such as Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, and Entra ID is highly desirable.
• Strong analytical, troubleshooting, and stakeholder communication skills.
• Experience supporting or leading SIEM/SOC transformation, optimization, or modernization initiatives is preferred.

What we offer:

• Food vouchers and social benefits package
• Opportunity for career progression
• Young and vibrant team environment
• Competitive salary and performance bonuses
• Professional on-boarding and on-going trainings

Are you willing to build up your career with us? – We’ll be happy to receive your resume in English!

*Your personal data is secure with us.

** Only candidates selected for interview will be contacted

HCLTech is committed to protecting and securing the privacy and confidentiality of the Personal Data which it collects directly or indirectly from you when applying for a job at HCLTech either directly or through a third-party human resources agency. This notice (the “Notice”) outlines and explains how HCL Technologies Limited including its subsidiaries, local employing entities, associates, and affiliated companies [collectively referred to as “HCLTech”, “us,” “our”, or “we”] will process your Personal Data in accordance with applicable privacy legislation(s).