Snr Cybersecurity Consultant Engineer (Architecture, Infrastructure and Remediation)
LevelBlue LLC6 days ago
USA (city not specified)Senior
Responsibilities
- Lead SIEM design and implementation for greenfield SOC builds and brownfield optimization engagements.
- Onboard data sources and design ingestion, parsing, normalization, custom connectors, analytics rules, hunting queries, automation rules, playbooks, and workbooks.
- Design and build custom detection content aligned with client threat profiles and available telemetry.
- Integrate and operationalize Microsoft Defender XDR.
- Assess requirements and advise on Microsoft Purview, Entra ID, Defender for Cloud, Azure security, and Copilot implementation and configuration.
- Build Sentinel automation rules, Logic Apps workflows, and analyst response actions.
- Produce use-case catalogs, detection design records, automation and playbook designs, implementation plans, gap analyses, and maturity roadmaps.
- Facilitate client workshops, capture requirements and decisions, manage risks and scope changes, and provide SME guidance.
- Manage concurrent client engagements independently and support pre-sales estimates, technical scope, and solution shaping.
Requirements
- Senior consulting or professional-services delivery experience owning client workshops, requirements discovery, engagement scope, and signed-off deliverables.
- Hands-on production experience with Microsoft Sentinel engineering, including analytic rule design, query tuning, false-positive reduction, and use-case operationalization.
- Experience producing detection design records containing use-case scenarios, data sources, KQL, and tuning notes.
- Hands-on Microsoft Defender XDR experience, including Defender for Endpoint plus at least one of Identity, Office, or Cloud Apps, in a detection or SOC-integration context.
- Hands-on Microsoft Purview configuration in a security or compliance context connected to monitoring or control design.
- Experience with firewall or network security reviews, Active Directory security, Azure security, AWS security, multi-cloud posture work, Splunk, or SentinelOne is useful.
- Desirable certifications include SC-200, SC-500/AZ-500, SC-100, SC-300, SC-400, Splunk ES Admin or Splunk Architect, GIAC detection or incident response certifications such as GCIA or GCIH, and CISSP.
Benefits
- Flexible work arrangement with in-person collaboration for key moments based on role, team, and business needs.
- Employment is open to candidates legally authorized to work in the United States.
About LevelBlue LLC
LevelBlue provides managed security, detection and response, threat intelligence, and incident response services for enterprises and public-sector organizations, delivered via subscriptions and professional services. Its portfolio spans MDR, MSS, penetration testing, SIEM support, and cyber advisory. LevelBlue is the parent of Trustwave, expanding its global security services footprint and research capabilities.