Senior Security Operations Engineer

About the role

TeKnowledge is looking for a Senior Security Operations Engineer to lead advanced threat detection, incident response, security engineering, cloud security and automation across the organization. The role serves as the technical escalation point and works closely with infrastructure, network, cloud and architecture teams.

Key responsibilities

• Lead investigations of major cyber incidents, act as escalation point and drive incident response including containment, forensics and recovery.
• Design, implement and maintain enterprise‑wide security controls, conduct threat hunting across endpoint, cloud, identity and network environments, and develop detection use cases.
• Own Microsoft security platforms (Sentinel, Defender XDR suite, Purview, Entra ID Protection, PIM) and create advanced KQL detections, analytics rules and SOAR automations with Logic Apps.
• Design, secure and troubleshoot Azure infrastructure and networking (VNets, hub‑and‑spoke, firewalls, Application Gateway, WAFA, ExpressRoute, VPN, etc.) and enforce Zero‑Trust principles.
• Lead vulnerability management, drive attack‑surface reduction and mentor junior security engineers.

Required profile

• Extensive hands‑on experience with Microsoft security technologies and Azure security/networking in enterprise‑scale hybrid cloud environments.
• Proven track record leading incident response, threat hunting and security automation projects.
• Strong collaboration skills with infrastructure, network, cloud and compliance teams.

Required skills

• Microsoft Sentinel, Microsoft Defender for Endpoint, Identity, Office 365, Cloud Apps, Defender for Cloud, Microsoft Purview, Entra ID Protection, Privileged Identity Management.
• Azure Security, Azure Defender for Cloud, Azure Policy, Conditional Access, Key Vault, Cloud Security Posture Management.
• Azure networking components: VNets, hub‑and‑spoke, VNet peering, gateways, Azure Firewall, Application Gateway, WAFA, Bastion, Private Endpoints, Private DNS, Route Tables, Virtual WAN, Network Watcher, ExpressRoute, Site‑to‑Site VPN.
• KQL, Logic Apps, SOAR automation, playbook development.