Senior Consultant - Microsoft Sentinel and Defender Engineer
Ernst and Young2 months ago
Calgary, CanadaSenior
Responsibilities
- Lead the technical design and implementation of Microsoft Sentinel SIEM and SOAR solutions for MDR clients.
- Design workspace, ingestion, retention, access-control, and multi-tenant operating models.
- Configure Sentinel, Log Analytics workspaces, data connectors, diagnostic settings, content solutions, watchlists, and Azure resources.
- Create, test, tune, document, and maintain KQL analytics rules, hunting queries, parsers, functions, and detection use cases.
- Integrate telemetry from Microsoft Defender XDR, Microsoft Defender for Cloud, Microsoft Entra ID, Azure, Microsoft 365, and third-party security technologies.
- Build Sentinel automation rules and Azure Logic Apps playbooks for enrichment, triage, notification, containment, remediation, ticketing, and evidence collection.
- Develop Sentinel workbooks and service dashboards for threats, incidents, coverage, operational performance, and data ingestion.
- Implement secure cross-tenant access with Azure Lighthouse and Microsoft Entra B2B collaboration.
- Troubleshoot onboarding, data-connector, ingestion, query, automation, and access issues across customer environments.
- Support incident investigation, threat hunting, detection tuning, platform health, and continuous MDR service improvement.
- Lead client workshops, gather requirements, explain designs, provide recommendations, and produce technical documentation and knowledge-transfer materials.
- Provide technical guidance and peer review to engineers and analysts without direct people-management responsibility.
Requirements
- Substantial hands-on experience designing, implementing, and operating Microsoft Sentinel in enterprise or managed-service environments.
- Advanced KQL skills and experience developing analytics rules, hunting queries, functions, parsers, workbooks, and detection content.
- Strong experience with Microsoft Defender XDR and Defender products covering endpoints, identity, email and collaboration, cloud apps, and cloud workloads.
- Hands-on experience building Azure Logic Apps, Sentinel playbooks, and automation rules, including API integration, authentication, permissions, error handling, and monitoring.
- Experience architecting Sentinel deployments involving workspace strategy, data connectors, ingestion, retention, role-based access control, and cost management.
- Experience implementing and supporting multi-tenant access with Azure Lighthouse and Microsoft Entra B2B collaboration.
- Understanding of incident response, threat hunting, detection engineering, security operations, and common threat frameworks such as MITRE ATT&CK.
- Ability to lead client technical discussions, translate requirements into implementable designs, communicate complex concepts clearly, work independently, manage priorities, document work, and own technical outcomes.
- Bachelor's degree or diploma in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
- Typically seven or more years of cybersecurity experience, including significant recent Microsoft Sentinel and Defender engineering experience.
- Experience in a client-facing consulting, MSSP, MDR, or enterprise security engineering role.
- Microsoft Certified: Security Operations Analyst Associate (SC-200) is preferred.
- Azure, identity, architecture, or security certifications are considered an asset.
- Experience with source control, infrastructure as code, CI/CD, deployment automation, or integrations with IT service management, threat intelligence, network security, identity, endpoint, email, or cloud platforms is considered an asset.
Benefits
- Comprehensive medical, prescription drug, and dental coverage.
- Defined contribution pension plan, vacation policy, statutory holidays, paid personal days, and firm-paid days.
- Programs and benefits supporting physical, financial, and social well-being.
- Support and coaching from experienced colleagues, learning opportunities, career development, and role flexibility.
- Position available in Toronto, Calgary, Vancouver, or Edmonton.
About Ernst and Young
Ernst & Young (EY) provides audit/assurance, tax, consulting, strategy and transactions services to enterprises, financial institutions, and public‑sector clients. Structured as a global network of partner‑owned member firms, it sells professional services on a fee basis, including a dedicated Financial Services Organization for banking, insurance, and capital markets. Headquartered in London, EY was formed in 1989 from the merger of Ernst & Whinney and Arthur Young, and operates in 150+ countries.