Microsoft Sentinel Log Engineer

Location: 100% remote work Salary: 170 – 200 PLN net/h (B2B via Experis)

Responsibilities:

• Onboard on-prem servers to Sentinel with Azure Arc and AMA. Validate log coverage and fix any servers that aren't reporting.
• Design and build the collection layer for devices that can't run the agent. This means syslog/CEF forwarders behind load balancers in Azure, built for scale and fault tolerance.
• Close Azure and AWS logging gaps by connecting control-plane and data-plane logs to Sentinel across all tenants and accounts.
• Optimize log routing and cost. This covers DCRs, table routing, and moving lower-value logs to the Sentinel data lake tier while still meeting the 1-year retention requirement.
• Build coverage monitoring with dashboards and alerts that show agent health, onboarding against inventory, and gaps in log sources.
• Document standards and hand over logging standards, runbooks and architecture diagrams to the InfoSec/SOE team.

Requirements:

• 5+ years in SIEM or security logging engineering, including at least 3 years with Microsoft Sentinel / Log Analytics.
• Hands-on Azure Arc and Azure Monitor Agent deployment at scale. This includes Data Collection Rules, Private Link/AMPLS and troubleshooting connectivity.
• Has designed and run syslog/CEF forwarder architecture for firewalls, switches, routers and appliances. This includes HA, load balancing and throughput sizing.
• Azure Policy for at-scale agent and DCR deployment across multiple tenants and management groups.
• Strong KQL for validating ingestion, checking coverage and finding gaps.
• Strong Linux knowledge.
• Cloud logging: Azure diagnostic, activity and resource logs, plus AWS CloudTrail, VPC Flow Logs and S3 data events through the Sentinel connectors.
• Sentinel cost and retention design: table tiers, the data lake, filtering and transformations.
• Comfortable with automated deployment using Ansible, GPO or scripting (PowerShell/Python), within a formal change process.
• Background in networking, such as Cisco ASA, Palo Alto, DNS and firewall rules for agent connectivity.
• Has handled logging for managed or customer-facing environments.
• Certifications such as SC-200, AZ-500 or AZ-104. AWS Security Specialty is a plus.

Our offer:

• MultiSport Plus
• Group insurance
• Medicover Premium