Snr Cybersecurity Consultant Engineer (Architecture, Infrastructure and Remediation)
About The Position
LevelBlue’s Professional Services Organization is hiring a Senior Cybersecurity Consultant for client-facing delivery across SIEM engineering, Microsoft security advisory and implementation, and security operations optimization. This is a hands-on consulting and engineering role, not a monitoring-only or analyst position. The consultant owns design and build work on live engagements, including analytics, detection logic, security integrations, technical advisory, and client-ready delivery artifacts. The role involves running workshops, providing subject-matter guidance to technical and non-technical stakeholders, and delivering solutions clients can operate. The consultant works independently and in mixed teams, manages work across concurrent clients, and contributes to improving practice proposals and delivery assets. The primary platform is Microsoft Sentinel, particularly analytic rule design and build. Additional SIEM experience with Splunk or SentinelOne AI SIEM is valued. Engagements may include greenfield SOC builds and brownfield optimization, Microsoft Defender XDR integration and operationalization, and advisory or implementation work involving Microsoft Purview, Entra ID, Defender for Cloud, Azure security, and Copilot. The role also supports pre-sales through effort estimates, technical scoping, and solution shaping. The position is open to candidates legally authorized to work in the United States. LevelBlue supports flexible work and brings people together in person for key moments based on role, team, and business needs.
Requirements
- Senior consulting or professional-services delivery experience, including ownership of client workshops covering business requirements, use-case discovery, engagement scope, and signed-off deliverables.
- Hands-on Microsoft Sentinel engineering in production, including analytic rule design and build, query tuning and optimization, false-positive reduction, and use-case operationalization.
- Experience producing detection design records (AIR DDRs), including use-case scenarios, data sources, KQL, and tuning notes.
- Hands-on Microsoft Defender XDR experience in a detection or SOC-integration context, including Defender for Endpoint plus at least one of Identity, Office, or Cloud Apps.
- Hands-on Microsoft Purview configuration experience in a security or compliance context connected to monitoring or control design.
- Legal authorization to work in the United States.
Nice To Haves
- Hands-on Microsoft Purview build experience.
- Firewall or network security configuration review experience, including policy quality, SIEM logging, and segmentation relevant to detections.
- Active Directory security review experience beyond detections, including privileged access, delegation, hardening, and hybrid identity.
- Azure security review experience beyond Defender for Cloud or Sentinel, including landing-zone and control-plane hygiene.
- AWS security review or multi-cloud posture experience.
- Working knowledge of Splunk or SentinelOne.
- Experience with broader control reviews that inform a security operations or threat detection and response roadmap.
- Relevant certifications such as SC-200 or SC-500 (AZ-500).
- Useful certifications include SC-100, SC-300, SC-400, Splunk ES Admin or Splunk Architect, GIAC detection/IR certifications such as GCIA or GCIH, or CISSP.
Responsibilities
- Deliver client engagements across a range of service lines.
- Lead SIEM design and implementation for greenfield SOC builds and brownfield optimization, including data-source onboarding, telemetry analysis, ingestion design, parsing and normalization, custom connectors, analytics rules, hunting queries, automation rules and playbooks, workbooks, incident process alignment, and use-case documentation.
- Design and build custom detection content aligned to clients’ threat profiles and available telemetry.
- Integrate and operationalize Microsoft Defender XDR.
- Assess requirements and advise on best-practice implementation and configuration for Microsoft Purview, Entra ID, Defender for Cloud, Azure security, and Copilot; provide guided implementation and hands-on configuration when required.
- Discover Microsoft Purview requirements, recommend target configurations, and explain implementation options for information protection, DLP, audit, and related controls; hands-on build is desirable.
- Build practical automation, including Sentinel automation rules, Logic Apps, and analyst response actions, where it improves response quality.
- Produce client-ready design and build artifacts, such as use-case catalogs, automation and playbook designs, implementation plans, gap analyses, and tactical maturity roadmaps with executive summaries.
- Facilitate workshops and discussion sessions, capturing requirements, decisions, risks, and scope changes.
- Support pre-sales with effort estimates, technical scope, and solution shaping.
- Manage work across concurrent clients and contribute to improving practice proposals and delivery assets.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
