OT SIEM Engineer

At Sword, we help power, secure and transform the organisations that keep the UK running. Supporting customers across Critical National Infrastructure, energy, public sector and enterprise markets, we combine deep industry expertise with leading technology services spanning managed services, cyber security, cloud, data, AI and digital transformation.

Join Sword and you'll be part of a team solving complex challenges, delivering real-world impact and working alongside talented colleagues who care deeply about quality, collaboration and customer success.

About the Role:

As an OT SIEM Engineer, you will play a key role in strengthening cyber security monitoring and threat detection capabilities across complex enterprise and Operational Technology (OT) environments, with a particular focus on Microsoft Sentinel.

This is a hands-on engineering role where you will support the development and enhancement of SIEM capabilities, integrating security telemetry, developing detection content and implementing automation to improve security operations. You'll work closely with Cyber Defence and Security Operations teams, helping to deliver effective monitoring and threat detection solutions within Critical National Infrastructure.

You'll also support the migration and integration of log data from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel, contributing to the ongoing development of a modern, scalable security monitoring capability.

You'll be joining at an exciting time as we continue to grow our cyber security capabilities and deliver increasingly complex solutions for our customers. Sword was recently named Splunk 2026 EMEA Services Partner of the Year for Outstanding Regional Partnership in the AI-Driven Era, recognising the strength of our technical expertise, customer partnerships and the work being delivered across our practice. It's a great opportunity to become part of that continued growth while helping protect the systems and infrastructure that deliver essential services.

As an OT SIEM Engineer, you will:

• Onboard and integrate log sources into Microsoft Sentinel across enterprise and Operational Technology environments.
• Develop and maintain custom parsers, data transformations and normalisation processes to improve the quality and consistency of security telemetry.
• Design, develop and optimise Kusto Query Language (KQL) queries to support security monitoring and threat detection.
• Create, tune and maintain analytics rules, alerts and detection logic to strengthen security monitoring capabilities.
• Develop and support Logic Apps, Playbooks and SOAR automation workflows to improve the efficiency of security operations.
• Support the migration and integration of security telemetry from existing SIEM platforms, including LogRhythm, into Microsoft Sentinel.
• Implement and maintain CI/CD pipelines using Azure DevOps and Git to support the deployment and management of SIEM content.
• Automate the deployment, configuration and ongoing management of Sentinel content and integrations.
• Work closely with Cyber Defence and Security Operations teams to enhance monitoring, threat detection and incident response capabilities.
• Contribute to threat hunting, detection engineering and continuous improvement activities.
• Apply security engineering best practice within complex, highly regulated environments.