About the Role
LevelBlue’s Professional Services Organization is hiring a Senior Cybersecurity Engineering Consultant for client-facing delivery across SIEM engineering, Microsoft security advisory and implementation, and security operations optimization. This is not an analyst role. You will own design and build work on live engagements: analytics, detection logic, security integrations, technical advisory, and client-ready delivery artifacts. You will run workshops, provide SME-level guidance for technical and non-technical stakeholders, and leave clients with something they can operate. You will operate independently and in mixed teams, manage your own work across concurrent clients, and improve practice proposals and delivery assets.
Role Expectations / Key Responsibilities
Engagement Delivery
Deliver engagements across a range of service lines. Lead SIEM design and implementation on greenfield SOC builds and brownfield optimization: data-source onboarding (e.g., telemetry analysis, ingestion design, parsing and normalization, custom connectors), analytics rules, hunting queries, automation rules and playbooks, workbooks, incident process alignment, and use-case documentation.
Design and build custom detection content aligned to the client’s threat profile and available telemetry.
Integrate and operationalize Microsoft Defender XDR.
Assess requirements and advise on best-practice implementation and configuration for Microsoft Purview, Entra ID, Defender for Cloud, Azure security, Copilot. Deliver guided implementation and hands-on configuration when required.
Microsoft Purview: you can discover client requirements, recommend a target configuration, and explain how to implement it (information protection, DLP, audit, or related controls as relevant). Hands-on build is desirable.
Build practical automation where it improves response quality: Sentinel automation rules, Logic Apps, and analyst response actions.
Produce client-ready design and build artifacts: for example, use case catalog, automation/playbook designs, implementation plans, gap analyses, tactical maturity roadmaps with executive summaries.
Facilitate workshops and discussion sessions; capture requirements, decisions, risks, and scope changes.
Support pre-sales with effort estimates, technical scope, and solution shaping.
Experience & Qualifications
Required
Senior consulting or professional-services delivery (not only an internal SOC or engineering seat): you have owned client workshops around business requirements and use case discovery, engagement scope, and signed-off deliverables.
Hands-on Microsoft Sentinel engineering in production, including analytic rule design and build, query tuning and optimization, false-positive reduction, and use-case operationalization.
Experience producing detection design records (AIR DDRs): our use case notes covering use case scenarios, data sources, KQL, tuning notes.
Hands-on Microsoft Defender XDR (at least Defender for Endpoint plus one of Identity / Office / Cloud Apps) in a detection or SOC-integration context.
Hands-on Microsoft Purview configuration in a security or compliance context connected to monitoring or control design.
Useful
Experience in any of the following is a plus and may be used on engagements; it does not replace SIEM engineering or Microsoft security delivery.
Firewall / network security configuration reviews (policy quality, logging to SIEM, segmentation relevant to detections).
Active Directory security reviews (beyond detections): privileged access, delegation, hardening, hybrid identity.
Azure security reviews (beyond Defender for Cloud / Sentinel): landing-zone and control-plane hygiene.
AWS security reviews or multi-cloud posture work.
Splunk or SentinelOne (working knowledge).
Broader control reviews that feed a security operations or threat detection and response roadmap.
Certifications (desirable)
Most relevant: SC-200; SC-500 (AZ-500)
Also useful: SC-100, SC-300, SC-400; Splunk ES Admin or Splunk Architect; GIAC detection/IR (e.g. GCIA, GCIH); CISSP
Skills Required
- Senior consulting or professional-services delivery experience, including client workshops, business requirements, use-case discovery, scope management, and signed-off deliverables
- Hands-on Microsoft Sentinel engineering in production, including analytic rule design, query tuning, false-positive reduction, and use-case operationalization
- Experience producing detection design records covering scenarios, data sources, KQL, and tuning notes
- Hands-on Microsoft Defender XDR experience, including Defender for Endpoint and at least one of Identity, Office, or Cloud Apps
- Hands-on Microsoft Purview configuration in a security or compliance context
- Firewall or network security configuration review experience
- Active Directory security review experience
- Azure security review experience
- AWS security review or multi-cloud posture experience
- Working knowledge of Splunk or SentinelOne
- Broader security control review experience supporting threat detection and response roadmaps
- SC-200 or SC-500/AZ-500 certification
- SC-100, SC-300, SC-400, Splunk ES Admin, Splunk Architect, GIAC detection/incident response, or CISSP certification
What We Do
LevelBlue. Cybersecurity Simplified. Introducing a new alliance from AT&T and WillJam Ventures, we simplify cybersecurity through award-winning managed security services, experienced strategic consulting, threat intelligence and renowned research. Our team is a seamless extension of yours, providing transparency and visibility into security posture and continuously working to strengthen it. We harness security data from numerous sources and enrich it with Artificial Intelligence to deliver real-time threat intelligence. This enables more accurate and precise decision making. With a large, always-on global presence, LevelBlue sets the standard for cybersecurity today and tomorrow. We easily and effectively manage risk, so you can focus on your business. Welcome to LevelBlue. Where cybersecurity meets innovation.
