Microsoft Sentinel Log Engineer

Experis to światowy lider rekrutacji specjalistów i kadry zarządzającej w kluczowych obszarach IT.

• 5+ years in SIEM or security logging engineering, with at least 3 years experience with Microsoft Sentinel/Log Analytics.
• Hands-on experience with Azure Arc and Azure Monitor Agent deployment at scale, including Data Collection Rules, Private Link/AMPLS, and connectivity troubleshooting.
• Designed and managed syslog/CEF forwarder architectures for firewalls, switches, routers, and appliances, including HA, load balancing, and throughput sizing.
• Experience with Azure Policy for agent and DCR deployment across tenants and management groups.
• Strong KQL skills for log ingestion validation and gap analysis.
• Strong knowledge of Linux.
• Experience with cloud logging from Azure diagnostic, activity and resource logs, and AWS CloudTrail, VPC Flow Logs, and S3 events via Sentinel connectors.
• Design expertise for Sentinel cost and retention: table tiers, data lake, filtering, and transformations.
• Comfortable with automated deployment using Ansible, GPO or scripting (PowerShell, Python) within formal change processes.
• Background in networking (e.g., Cisco ASA, Palo Alto, DNS, firewall rules for agent connectivity).
• Experience handling logging for managed or customer-facing environments.
• Relevant certifications such as SC-200, AZ-500, AZ-104; AWS Security Specialty is a plus.

• Onboard on-prem servers to Sentinel with Azure Arc and Azure Monitor Agent, validate log coverage, and fix any non-reporting servers.
• Design and build collection layers for devices unable to run agents using syslog/CEF forwarders behind load balancers in Azure, ensuring scalability and fault tolerance.
• Connect control-plane and data-plane logs from Azure and AWS tenants/accounts to Sentinel to close logging gaps.
• Optimize log routing and cost using Data Collection Rules (DCRs), table routing, and managing data retention tiers.
• Build coverage monitoring dashboards and alerts for agent health, onboarding status, and log source gaps.
• Document logging standards, create runbooks, and hand over architecture diagrams to InfoSec/SOE teams.