Microsoft Sentinel Security Consultant

The Microsoft Sentinel Security Consultant is a customer-facing, advisory role focused on translating Microsoft Sentinel telemetry into clear, actionable security guidance. This is not a traditional SOC role. Instead, it’s designed for professionals who enjoy analyzing patterns, explaining security findings, and coaching customers on how to improve their security posture over time. You’ll work closely with Spyglass Security Coaches, SecOps teams, and Customer Success Managers to help customers understand what Sentinel is telling them, why it matters, and what to do next.

Review and interpret Microsoft Sentinel incidents, analytics rules, detections, and trends for assigned customers

Analyze recurring security signals to identify attack patterns, control gaps, and risk trends over time

Develop, read, and explain KQL queries, workbooks, and Sentinel dashboards

Partner with MDR and SecOps teams to validate detections, distinguish real risk from noise, and convert findings into advisory recommendations

Guide customers on how to act on Sentinel insights, not just respond to alerts

Support and contribute to monthly Spyglass security coaching sessions

Translate technical Sentinel outputs into clear, business-relevant narratives

Participate in executive and technical security advisory discussions

Contribute to customer security roadmaps informed by Sentinel-driven insights

Assess customer security posture across Microsoft Sentinel, Microsoft Defender XDR, and Entra ID

Map Sentinel findings to security frameworks such as NIST CSF and CIS Controls

Identify gaps in telemetry, detection coverage, and control effectiveness

Support Spyglass flex work by helping scope, estimate, and validate customer security engagements

Develop customer-facing materials such as security narratives, coaching decks, and Sentinel-backed summaries

Collaborate closely with Security Coaches, Customer Success Managers, and SecOps teams