Microsoft Sentinel Log Engineer

Location: 100% remote work Salary: 170 – 200 PLN net/h (B2B via Experis)

• Onboard on-prem servers to Sentinel with Azure Arc and AMA. Validate log coverage and fix any servers that aren't reporting. • Design and build the collection layer for devices that can't run the agent. This means syslog/CEF forwarders behind load balancers in Azure, built for scale and fault tolerance. • Close Azure and AWS logging gaps by connecting control-plane and data-plane logs to Sentinel across all tenants and accounts. • Optimize log routing and cost. This covers DCRs, table routing, and moving lower-value logs to the Sentinel data lake tier while still meeting the 1-year retention requirement. • Build coverage monitoring with dashboards and alerts that show agent health, onboarding against inventory, and gaps in log sources. • Document standards and hand over logging standards, runbooks and architecture diagrams to the InfoSec/SOE team.

• 5+ years in SIEM or security logging engineering, including at least 3 years with Microsoft Sentinel / Log Analytics. • Hands-on Azure Arc and Azure Monitor Agent deployment at scale. This includes Data Collection Rules, Private Link/AMPLS and troubleshooting connectivity. • Has designed and run syslog/CEF forwarder architecture for firewalls, switches, routers and appliances. This includes HA, load balancing and throughput sizing. • Azure Policy for at-scale agent and DCR deployment across multiple tenants and management gro