Senior Information Security Engineer

Berkley•Wilmington, DE

About The Position

The Senior Information Security Engineer leads engineering and enhancement of the Microsoft Sentinel SIEM platform, security data ingestion and automation, Azure and cloud security controls, and cross-functional efforts to strengthen the organization's security posture. The role covers Sentinel architecture and administration, data pipelines and integrations, ingestion validation and troubleshooting, log routing through Cribl, and scalable telemetry onboarding across on-premises, cloud, SaaS, and third-party platforms. The engineer applies engineering practices such as source control, testing, peer review, CI/CD deployment, documentation, and lifecycle management. They identify opportunities to automate repeatable security tasks and develop orchestration, detection-as-code, and automation-as-code capabilities. The position also designs and maintains Azure security controls and standards, translates business and regulatory requirements into technical controls, and advises infrastructure, cloud, and application teams on secure architecture and risk mitigation. The role includes implementing Microsoft Purview data protection capabilities, preparing technical standards and operational guidance, monitoring emerging threats, and presenting project status and recommendations to leadership. The engineer mentors junior security engineers and provides rotational Person in Charge coverage as a senior escalation point for complex incidents and operational decisions. The position collaborates with Security Operations, Infrastructure, Cloud, DevOps, and IT teams. Location: Wilmington, Delaware. Sponsorship is not offered.

Requirements

At least 5 years of experience as a Cloud Security Engineer, Information Security Engineer, or DevSecOps Engineer.
At least 5 years of experience with network, cloud, and computer system security, including user access controls, role-based access control, SSO, file permissions, firewall policies, and audit logs.
At least 5 years of experience with security systems, including firewalls, intrusion detection systems, endpoint protection systems, web application firewalls, vulnerability scanning software, privileged access management, data loss protection, log management, and content filtering.
At least 5 years of experience developing and deploying security solutions to defend against advanced cyber threats.
At least 5 years of experience reviewing and monitoring security systems to ensure they function properly and securely.
At least 5 years of experience investigating intrusion incidents and handling security incidents.

Responsibilities

Lead the engineering, deployment, administration, and continuous enhancement of Microsoft Sentinel, including workspace architecture, RBAC, retention management, and ingestion cost optimization.
Design, build, maintain, and troubleshoot security data ingestion pipelines and Sentinel connectors using Azure Monitor Agent, Data Collection Rules, CEF/Syslog, APIs, Event Hubs, Azure Functions, Logic Apps, and custom integrations.
Validate and troubleshoot ingested data using KQL and other tools, resolving data quality, schema, parsing, normalization, latency, performance, and reliability issues.
Engineer and support log routing, filtering, parsing, and transformation through Cribl, troubleshoot upstream ingestion issues, and onboard new data sources into Sentinel.
Establish scalable patterns for onboarding security telemetry from on-premises, cloud, SaaS, and third-party platforms, with automated monitoring and validation of ingestion pipelines.
Apply engineering best practices to Sentinel configurations and content, including source control, testing, peer review, CI/CD deployment, documentation, and lifecycle management.
Identify routine, repeatable, and manual security engineering tasks and develop automations to reduce effort, improve consistency, and accelerate response times.
Design, build, and maintain security automation and orchestration using Sentinel Automation Rules, Logic Apps, Azure Functions, PowerShell, Python, REST APIs, and Infrastructure as Code technologies including Bicep, ARM, and Terraform.
Develop and maintain detection-as-code and automation-as-code practices, integrate security content deployment into CI/CD pipelines, and measure automation outcomes.
Design, implement, and maintain Azure security controls and architecture standards, including Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, and secure landing zones.
Translate business, regulatory, and security requirements into technical controls, monitoring requirements, and security baselines across Azure, hybrid, and on-premises environments.
Provide technical guidance and hands-on support to infrastructure, cloud, and application teams on secure architecture, cloud security practices, and risk mitigation.
Design, implement, and maintain Microsoft Purview data protection capabilities, including DLP, sensitivity labels, information protection, Insider Risk Management, and auditing.
Prepare and maintain technical standards, procedures, security documentation, runbooks, and operational guidance.
Monitor emerging threats and industry trends and translate findings into detections, automation opportunities, and security control improvements.
Present project status, risks, and security initiatives to leadership, with actionable recommendations and clear communication of technical concepts.
Lead and mentor junior security engineers through design reviews, technical guidance, knowledge sharing, and career development support.
Provide rotational Person in Charge coverage as the senior escalation point for complex security incidents and operational decisions.
Collaborate with Security Operations, Infrastructure, Cloud, DevOps, and IT teams to design, implement, and improve security controls, monitoring, automation, and data protection.