... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
... engineering, threat hunting, and incident response * Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser ...
Principal Microsoft Cloud & AI Security Architect
Houston, TX · On-site
$62.50 - $83/hr
... Engineers. Key Skill Areas (Skill-Based Requirements) 1. Microsoft Sentinel & Advanced Analytics (You will use and lead with these skills daily) * Deep expertise in Microsoft Sentinel architecture ...
Principal Microsoft Cloud & AI Security Architect
Houston, TX · On-site
$62.50 - $83/hr
... Engineers. Key Skill Areas (Skill-Based Requirements) 1. Microsoft Sentinel & Advanced Analytics (You will use and lead with these skills daily) * Deep expertise in Microsoft Sentinel architecture ...
Microsoft Security Engineer Location: Los Angeles, CA - Hybrid (3 days work from office) Duration ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. Participate in incident ...
Microsoft Security Engineer Location: Los Angeles, CA - Hybrid (3 days work from office) Duration ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. Participate in incident ...
Hi Good Morning, Microsoft Security Engineer Location: Los Angeles, CA Long Term This role requires ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. Participate in incident ...
Hi Good Morning, Microsoft Security Engineer Location: Los Angeles, CA Long Term This role requires ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. Participate in incident ...
The working position is On Site The Software Developer II performs advanced (senior-level) software development work focused on designing, building, testing, and optimizing Microsoft Sentinel ...
Quick apply
The working position is On Site The Software Developer II performs advanced (senior-level) software development work focused on designing, building, testing, and optimizing Microsoft Sentinel ...
Role: Microsoft Security Engineer Location: Los Angeles, CA (Hybrid) · Implement and optimize ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. · Participate in incident ...
Quick apply
Role: Microsoft Security Engineer Location: Los Angeles, CA (Hybrid) · Implement and optimize ... Office 365, Sentinel, Microsoft Purview, and Entra ID Protection. · Participate in incident ...
Sr Microsoft Cloud Architect
$110K - $180K/yr
Define architectural standards, reference designs, and best practices Security Engineering (Hands-On Required) * Architect, deploy, and manage Microsoft Sentinel in production environments * Design ...
Sr Microsoft Cloud Architect
$110K - $180K/yr
Define architectural standards, reference designs, and best practices Security Engineering (Hands-On Required) * Architect, deploy, and manage Microsoft Sentinel in production environments * Design ...
Familiarity with Microsoft Sentinel use case development and tuning (preferred) Preferred Certifications * AZ-104: Microsoft Azure Administrator Associate * AZ-500: Microsoft Azure Security Engineer ...
Quick apply
Familiarity with Microsoft Sentinel use case development and tuning (preferred) Preferred Certifications * AZ-104: Microsoft Azure Administrator Associate * AZ-500: Microsoft Azure Security Engineer ...
Microsoft Sentinel Engineer information
See salary details
$38K - $52K
5% of jobs
$52K - $65.9K
7% of jobs
$65.9K - $79.9K
9% of jobs
$82.8K is the 25th percentile. Wages below this are outliers.
$79.9K - $93.8K
14% of jobs
The median wage is $106.4K / yr.
$93.8K - $107.8K
16% of jobs
$107.8K - $121.7K
13% of jobs
$121.7K - $135.7K
6% of jobs
$143.1K is the 75th percentile. Wages above this are outliers.
$135.7K - $149.6K
8% of jobs
$149.6K - $163.6K
8% of jobs
$163.6K - $177.5K
7% of jobs
$177.5K - $191.5K
5% of jobs
$38K
$115.9K
$191.5K
How much do microsoft sentinel engineer jobs pay per year?
As of Jun 12, 2026, the average yearly pay for microsoft sentinel engineer in the United States is $115,864.00, according to ZipRecruiter salary data. Most workers in this role earn between $83,000.00 and $151,500.00 per year, depending on experience, location, and employer.
What is the difference between Microsoft Sentinel Engineer vs Security Analyst?
| Aspect | Microsoft Sentinel Engineer | Security Analyst |
|---|---|---|
| Certifications | Microsoft Certified: Security, Compliance, and Identity Fundamentals; Microsoft Certified: Security Operations Analyst Associate | CompTIA Security+, GIAC Security Essentials (GSEC), CISSP (preferred) |
| Work Environment | Focus on configuring, deploying, and managing Microsoft Sentinel for threat detection and response | Monitor security alerts, analyze threats, and implement security measures across systems |
| Industry Usage | Primarily in organizations using Microsoft security tools and cloud services | Across various industries, often in security operations centers (SOCs) |
The Microsoft Sentinel Engineer specializes in deploying and managing Microsoft Sentinel to enhance security monitoring, while the Security Analyst focuses on analyzing security data and responding to threats across multiple platforms. Both roles require security certifications and work in security-focused environments, but their core responsibilities differ in scope and technical focus.
What are the key skills and qualifications needed to thrive as a Microsoft Sentinel Engineer, and why are they important?
To thrive as a Microsoft Sentinel Engineer, you need strong skills in cybersecurity, incident response, and cloud security, often supported by experience with SIEM solutions and relevant certifications like Microsoft Certified: Security Operations Analyst Associate. Familiarity with Microsoft Sentinel, Kusto Query Language (KQL), Azure security tools, and automation platforms such as Logic Apps is essential. Critical thinking, problem-solving, and effective communication are key soft skills for analyzing threats and collaborating across teams. These skills and qualities are important for ensuring robust threat detection, efficient incident response, and maintaining a resilient security posture in cloud environments.
What are some common challenges Microsoft Sentinel Engineers face when integrating Sentinel with diverse security tools?
Microsoft Sentinel Engineers often encounter challenges when integrating Sentinel with a variety of security tools and data sources due to differences in log formats, API compatibility, and data volume. Ensuring seamless data ingestion while maintaining performance and security can require advanced configuration and troubleshooting. Collaboration with network, infrastructure, and application teams is crucial to understand source systems and align on integration requirements. Continuous learning is important, as new connectors and features are frequently released by Microsoft to improve integration processes.
What is a Microsoft Sentinel Engineer?
A Microsoft Sentinel Engineer is a cybersecurity professional responsible for implementing, configuring, and managing Microsoft Sentinel, which is a cloud-native Security Information and Event Management (SIEM) solution. These engineers design and deploy security monitoring, automate threat detection, and respond to incidents using Sentinel's tools and analytics. They also integrate data sources, create custom detection rules, and ensure the organization's cloud and on-premises infrastructure is adequately monitored against security threats. Their work helps organizations quickly identify, investigate, and mitigate cyber threats.
Other
Posted 22 days ago
Deloitte rating
8.1
Based on 86 frontline employees who took The Breakroom Quiz
58th of 138 rated financial services
Job description
Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success.
Recruiting for this role ends on 12/31/2026.
Work you'll do
As a Senior Consultant, Sentinel on the Deloitte Cyber team, you will be responsible for:
- Architecting, designing, and implementing Microsoft Sentinel, Microsoft Defender for Endpoint, and extended detection and response solutions across Azure, Amazon Web Services, and Google Cloud Platform environments
- Developing Kusto Query Language queries, functions, analytical rules, dashboards, workbooks, and automation playbooks to support monitoring, detection engineering, threat hunting, and incident response
- Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser development, custom data source integration, log forwarder deployment, and log collection optimization
- Performing end-to-end event analysis, incident detection, escalation management, false positive tuning, and runbook-driven response activities using documented procedures and playbooks
- Implementing and maintaining advanced Microsoft Sentinel capabilities, including threat intelligence integration, user and entity behavior analytics, custom dashboards, workbook development, and third-party or software-as-a-service application connectivity
- Creating technical reports, security visualizations, operating procedures, and lifecycle documentation to support client security, operational, and business requirements
A successful candidate would possess these skills:
- Ability to work independently and collaborate as part of a team
- Effective written and verbal communication skills
- Meticulous attention to detail and quality of work product
- Ability to build and sustain professional relationships
- Ability to lead projects or workstreams
- Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
- Strong interpersonal skills and professional demeanor
- Ability to meet deadlines
- Ability to provide clear guidance to others
The team
Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success.
Qualifications
Required:
- 4+ years of experience architecting, designing, and implementing Microsoft Sentinel, endpoint detection and response, or extended detection and response solutions in enterprise environments
- 4+ years of experience with security information and event management, detection engineering, log management, or security operations in Azure, Amazon Web Services, or Google Cloud Platform environments
- Experience developing Kusto Query Language queries and functions, analytical rules, dashboards, workbooks, and automation playbooks in Microsoft Sentinel
- Experience migrating from legacy security information and event management platforms to Microsoft Sentinel, including parser development, custom data source integration, and log collection or forwarder deployment
- Experience with scripting or automation tools such as PowerShell, Python, or Terraform for security operations or platform administration
- Ability to travel 50%, on average, based on the work you do and the clients and industries/sectors you serve.
- Limited immigration sponsorship may be available.
Preferred:
- Bachelor's degree in Computer Science, Cyber Security, Information Security, Engineering, or Information Technology
- Experience with threat intelligence integration, user and entity behavior analytics, or threat hunting aligned to MITRE ATT&CK
- Experience implementing Microsoft Defender XDR, Microsoft Defender products, Azure Arc, or Microsoft Sentinel pricing models
- Experience integrating native, third-party, or software-as-a-service applications with Microsoft Sentinel
- Microsoft Sentinel Ninja Training Level 400 completion
- One or more certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Certified Cloud Security Professional, Certificate of Cloud Security Knowledge, Certified Information Systems Security Professional, Cisco Certified Network Professional, or Cisco Certified Network Associate
The wage range for this role takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; and other business and organizational needs. The disclosed range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Deloitte, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is $105,400 to $207,800.
You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.
Qualifications:Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success.
Recruiting for this role ends on 12/31/2026.
Work you'll do
As a Senior Consultant, Sentinel on the Deloitte Cyber team, you will be responsible for:
- Architecting, designing, and implementing Microsoft Sentinel, Microsoft Defender for Endpoint, and extended detection and response solutions across Azure, Amazon Web Services, and Google Cloud Platform environments
- Developing Kusto Query Language queries, functions, analytical rules, dashboards, workbooks, and automation playbooks to support monitoring, detection engineering, threat hunting, and incident response
- Supporting migrations from legacy security information and event management platforms to Microsoft Sentinel, including log onboarding, parser development, custom data source integration, log forwarder deployment, and log collection optimization
- Performing end-to-end event analysis, incident detection, escalation management, false positive tuning, and runbook-driven response activities using documented procedures and playbooks
- Implementing and maintaining advanced Microsoft Sentinel capabilities, including threat intelligence integration, user and entity behavior analytics, custom dashboards, workbook development, and third-party or software-as-a-service application connectivity
- Creating technical reports, security visualizations, operating procedures, and lifecycle documentation to support client security, operational, and business requirements
A successful candidate would possess these skills:
- Ability to work independently and collaborate as part of a team
- Effective written and verbal communication skills
- Meticulous attention to detail and quality of work product
- Ability to build and sustain professional relationships
- Ability to lead projects or workstreams
- Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
- Strong interpersonal skills and professional demeanor
- Ability to meet deadlines
- Ability to provide clear guidance to others
The team
Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success.
Qualifications
Required:
- 4+ years of experience architecting, designing, and implementing Microsoft Sentinel, endpoint detection and response, or extended detection and response solutions in enterprise environments
- 4+ years of experience with security information and event management, detection engineering, log management, or security operations in Azure, Amazon Web Services, or Google Cloud Platform environments
- Experience developing Kusto Query Language queries and functions, analytical rules, dashboards, workbooks, and automation playbooks in Microsoft Sentinel
- Experience migrating from legacy security information and event management platforms to Microsoft Sentinel, including parser development, custom data source integration, and log collection or forwarder deployment
- Experience with scripting or automation tools such as PowerShell, Python, or Terraform for security operations or platform administration
- Ability to travel 50%, on average, based on the work you do and the clients and industries/sectors you serve.
- Limited immigration sponsorship may be available.
Preferred:
- Bachelor's degree in Computer Science, Cyber Security, Information Security, Engineering, or Information Technology
- Experience with threat intelligence integration, user and entity behavior analytics, or threat hunting aligned to MITRE ATT&CK
- Experience implementing Microsoft Defender XDR, Microsoft Defender products, Azure Arc, or Microsoft Sentinel pricing models
- Experience integrating native, third-party, or software-as-a-service applications with Microsoft Sentinel
- Microsoft Sentinel Ninja Training Level 400 completion
- One or more certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Certified Cloud Security Professional, Certificate of Cloud Security Knowledge, Certified Information Systems Security Professional, Cisco Certified Network Professional, or Cisco Certified Network Associate
The wage range for this role takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; and other business and organizational needs. The disclosed range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Deloitte, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is $105,400 to $207,800.
You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.
Education:Bachelor's DegreeEmployment Type: