Associate - Cybersecurity

Develop and maintain log rotation configurations/scripts for Linux and Windows sources, including detection and remediation of rotation issues.

Create scheduled health checks , KQL rules, and workbooks to detect connector failures, latency, heartbeat gaps, and log drop-offs.

Document common ingestion failure patterns (encoding errors, firewall/network issues, schema mismatches) with precise troubleshooting playbooks .

Maintain playbooks for character encoding issues (UTF-8, BOM) and solutions for encrypted log payloads or malformed syslog headers.

Lead Windows Event Forwarding (WEF) implementation via GPO with enhanced configurations, filtering, and troubleshooting best practices.

Configure and tune Sysmon, Syslog-NG, Rsyslog , and Logstash for Linux and application logs; implement JDBC or file-based DB integrations.

Create reusable templates for schema mapping and log parsing pipelines for non-standard applications and tools.

Build PowerShell/Bash scripts to automate onboarding of frequently used log sources.

Maintain or create ARM/Bicep templates for Sentinel infrastructure provisioning, including DCRs, diagnostic settings, and analytics rules.

Script or pipeline complex log transformations, parsing pipelines , and even alert tuning workflows (e.g., via Logic Apps).

Define and manage RBAC roles for Sentinel, data source connectors, and ingestion tools.

Implement Managed Identity-based ingestion for secure connections (e.g., Azure Function Apps, Logstash, REST APIs).

Audit and document access control , permission requirements, and secure token-based configurations used for custom integrations.

Master log source onboarding guidebook

SOP library for custom and native integrations

Collection of scripts and templates (DCR, KQL rules, health monitors, log rotation)

Workbook for ingestion health monitoring

Repository of common failure scenarios and fix playbooks