Senior Information Security Engineer

Berkley is seeking a Senior Information Security Engineer in Wilmington, DE (onsite) to lead and enhance Microsoft Sentinel as the organization’s enterprise SIEM. In this role, you’ll strengthen security monitoring through scalable ingestion pipelines, automation and orchestration, and Azure and data protection controls, while providing technical guidance and escalation coverage across engineering and security teams.

What you’ll do

• Lead engineering, deployment, administration, and continuous enhancement of Microsoft Sentinel, including workspace architecture, RBAC, retention management, and ingestion cost optimization.
• Design, build, maintain, and troubleshoot security data ingestion pipelines and Sentinel connectors using Azure Monitor Agent, Data Collection Rules, CEF/Syslog, APIs, Event Hubs, Azure Functions, Logic Apps, and custom integration patterns.
• Validate and troubleshoot ingested data with KQL and other tools, addressing data quality, schema, parsing, normalization, latency, performance, and ingestion reliability issues.
• Engineer and support log routing, filtering, parsing, and transformation through Cribl, including troubleshooting upstream ingestion and onboarding new data sources into Sentinel.
• Establish scalable onboarding patterns for security telemetry from on-premises, cloud, SaaS, and third-party platforms, including automated monitoring and pipeline validation.
• Apply engineering best practices for Sentinel configuration and content, including source control, testing, peer review, CI/CD deployment, technical documentation, and lifecycle management.
• Identify repeatable manual tasks across security engineering platforms and develop automations to improve consistency, reduce operational effort, and accelerate response times.
• Design, build, and maintain security automation and orchestration solutions using Sentinel Automation Rules, Logic Apps, Azure Functions, PowerShell, Python, REST APIs, and Infrastructure as Code technologies including Bicep, ARM, and Terraform.
• Develop detection-as-code and automation-as-code practices, integrating security content deployment into CI/CD pipelines and measuring automation outcomes such as operational efficiency and time savings.
• Design, implement, and maintain Azure security controls and security architecture standards, including Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, and secure landing zone architectures.
• Translate business, regulatory, and security requirements into technical controls, monitoring requirements, and security baselines across Azure, hybrid, and on-premises environments.
• Provide technical guidance and hands-on support to infrastructure, cloud, and application teams on secure architecture patterns, cloud security best practices, and risk mitigation strategies.
• Maintain Microsoft Purview data protection capabilities, including Data Loss Prevention (DLP), sensitivity labels, Insider Risk Management, and auditing solutions.
• Prepare and maintain technical standards, procedures, security documentation, runbooks, and operational guidance for Sentinel, cloud security, automation, and data protection capabilities.
• Monitor emerging threats and industry trends, translating findings into new detections, automation opportunities, and security control improvements.
• Provide project status, risks, and security initiative updates to leadership with actionable recommendations and clear communication of technical concepts.
• Lead and mentor junior security engineers through design reviews, knowledge sharing, and career development support.
• Serve as Person in Charge (PIC) on a rotational basis as the senior escalation point for complex security incidents and operational decisions.
• Collaborate with Security Operations, Infrastructure, Cloud, DevOps, and IT teams to continuously improve enterprise security controls, monitoring, automation, and data protection measures.

What you bring

• 5 years of experience as a Cloud Security Engineer, Information Security Engineer, or Devsecops Engineer.
• 5 years of experience in network, cloud, and computer system security, including security mechanisms such as user access controls, role-based access control, SSO, file permissions, firewall policies, and audit logs.
• 5 years of experience in security systems including firewalls, intrusion detection systems, endpoint protection systems, web application firewalls, vulnerability scanning software, privilege access management, data loss protection, log management, and content filtering.
• 5 years of experience developing and deploying security solutions to defend against advanced cyber threats.
• 5 years of experience reviewing and monitoring security systems to ensure they function properly and securely.
• 5 years of experience investigating intrusion incidents, conducting investigations, and handling security incidents.

Key technologies

• Microsoft Sentinel, Azure Monitor Agent, Data Collection Rules, CEF/Syslog, Azure Monitor, Event Hubs, Azure Functions, Logic Apps, APIs, KQL
• Cribl, Sentinel connectors, Sentinel Automation Rules
• PowerShell, Python, REST APIs
• Infrastructure as Code with Bicep, ARM, Terraform, plus CI/CD
• Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, secure landing zone architectures
• Microsoft Purview including Data Loss Prevention (DLP), sensitivity labels, Insider Risk Management, and auditing solutions
• SSO, RBAC, SaaS, on-premises

Location

Wilmington, DE (onsite)

Additional information

• Sponsorship: Sponsorship not offered for this role.
• Recruiting policy: Berkley does not accept unsolicited resumes from third party recruiting agencies or firms.