SOC Engineer – Microsoft Sentinel

Role Title: Engineer - SOC Specialist

Skills Required: SOC operations, Microsoft Sentinel administration, automation with Logic Apps/playbooks, cloud security (Azure/AWS), and KQL

Location: Calgary, Alberta

Work Style: 100% Onsite

Experience Required: 6-8 Years

Must Have Skills:

(Ideally should not be more than 3-5) Microsoft Sentinel, Microsoft Defender (for Endpoint/Cloud/Identity), Azure Security Center, Office 365 Security & Compliance, and Power Automate/Logic Apps for automation

Nice to Have Skills:

PowerShell scripting

Role Description:

1 Administer and maintain Microsoft Sentinel workspaces across multi‑cloud environments.

2 Configure and manage Sentinel data connectors.

3 Automate incident response workflows using Logic Apps and Sentinel playbooks.

4 Develop and optimize KQL queries for log analytics and threat hunting.

5 Implement custom rules, alerts, and analytics for proactive detection.

6 Ensure seamless ingestion of telemetry from diverse cloud services.

7 Automate repetitive SOC tasks to enhance operational efficiency.

8 Manage Sentinel dashboards and reporting for SOC visibility.

9 Troubleshoot connector issues and optimize ingestion pipelines.

10 Collaborate with cloud teams to secure Azure and hybrid workloads.

11 Document automation processes, playbooks, and connector configurations.

12 Provide guidance on Sentinel best practices and cloud security posture.

13 Proficient in Microsoft 365 administration and security configurations.

14 Strong communication and collaboration skills

15 Provide technical guidance for clients, team members and stakeholders on Microsoft Purview capabilities and best practices

16 Contribute to continuous improvement of SOC automation and administration processes.

17 Resolves customer issues through problem solving, collaboration, and research. May take escalated issues as needed. Documents technical work and research.

18 Performs in-depth product troubleshooting and remediation when needed.

19 Collaborates on cross-team and cross-product technical issues by working with resources from other groups as needed to resolve moderately complex customer issues