Microsoft Sentinel Log Engineer

Quick Facts

• Role: Microsoft Sentinel Log Engineer
• Work model: 100% remote
• Rate: 170–200 PLN net/hour (B2B via Experis)

Description

Design, build, and optimize log ingestion for Microsoft Sentinel across Azure and AWS environments, ensuring complete coverage, reliable collection, and cost/retention-aligned routing. You will onboard on-prem servers into Sentinel using Azure Arc and AMA, implement scalable syslog/CEF forwarders where agents can’t run, and connect control-plane/data-plane logs across tenants and accounts.

Responsibilities

• Onboard on-prem servers to Sentinel using Azure Arc and AMA; validate log coverage and fix servers that are not reporting.
• Design and build a collection layer for devices that cannot run an agent (syslog/CEF forwarders behind load balancers in Azure), optimized for scale and fault tolerance.
• Close Azure and AWS logging gaps by connecting control-plane and data-plane logs to Sentinel across all tenants and accounts.
• Optimize log routing and cost using DCRs, table routing, and moving lower-value logs to the Sentinel data lake tier while meeting 1-year retention.
• Build coverage monitoring with dashboards and alerts for agent health, onboarding vs. inventory, and missing log sources.
• Document standards and hand over logging standards, runbooks, and architecture diagrams to the InfoSec/SOE team.

Requirements

• 5+ years in SIEM or security logging engineering, including 3+ years with Microsoft Sentinel / Log Analytics.
• Hands-on Azure Arc and Azure Monitor Agent deployment at scale, including DCRs, Private Link/AMPS, and connectivity troubleshooting.
• Designed and run syslog/CEF forwarder architecture for firewalls, switches, routers, and appliances; includes HA, load balancing, and throughput sizing.
• Experience with Azure Policy for at-scale agent and DCR deployment across multiple tenants and management groups.
• Strong KQL for validating ingestion, checking coverage, and finding gaps.
• Strong Linux knowledge.
• Cloud logging experience: Azure diagnostic/activity/resource logs and AWS CloudTrail, VPC Flow Logs, and S3 data events via Sentinel connectors.
• Sentinel cost and retention design experience: table tiers, data lake tiering, filtering, and transformations.
• Comfortable automating deployment with Ansible, GPO, or scripting (PowerShell/Python) within a formal change process.
• Networking background for agent connectivity (e.g., Cisco ASA, Palo Alto, DNS, firewall rules).
• Experience handling logging for managed or customer-facing environments.
• Certifications such as SC-200, AZ-500, or AZ-104 (AWS Security Specialty is a plus).

Benefits

• MultiSport Plus
• Group insurance
• Medicover Premium