Microsoft Sentinel Platform Engineer

City: Pune

State/Province: Maharashtra

Posting Start Date: 3/17/26

Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO) is a leading technology services and consulting company focused on building innovative solutions that address clients' most complex digital transformation needs. Leveraging our holistic portfolio of capabilities in consulting, design, engineering, and operations, we help clients realize their boldest ambitions and build future-ready, sustainable businesses. With over 230,000 employees and business partners across 65 countries, we deliver on the promise of helping our customers, colleagues, and communities thrive in an ever-changing world. For additional information, visit us at www.wipro.com.

Job Description:

Job Description

The Sentinel Platform Engineer - L3 is the highest-tier technical expert responsible for end-to-end engineering, optimization, and advanced troubleshooting of the Microsoft Sentinel platform within the SOC. This role ensures platform reliability, architecture governance, seamless data ingestion, analytics development, automation, threat detection maturity, and integration with enterprise security controls.

• Own full lifecycle management of Microsoft Sentinel, including architecture design, scaling, performance optimization, and maintenance.
• Define and enforce Sentinel platform governance, naming standards, and RBAC policies.
• Design and enhance Log Analytics workspace architecture, data retention policies, and workspace linking.
• Ensure high availability, cost optimization, and platform resilience.

• Onboard, configure, and troubleshoot Sentinel data connectors (Syslog, CEF, AMA, custom connectors, API integrations).
• Build and manage scalable data ingestion pipelines for security logs from telco, cloud, network, and core systems.
• Optimize ingestion costs, data normalization (ASIM), and data mapping.

• Develop and optimize KQL-based analytic rules for advanced threat detection.
• Improve detection logic through threat hunting patterns, MITRE ATT&CK mapping, and false-positive reduction.
• Perform periodic health checks on analytics rule performance and data coverage.

• Build advanced Logic Apps and SOAR playbooks for automated response.
• Integrate automation across security tools, ITSM, identity systems, and network controls.
• Troubleshoot complex automation failures and enhance playbook efficiencies.

• Serve as final technical escalation point for Sentinel platform issues.
• Analyze and resolve ingest failures, connector breakdowns, workspace anomalies, and rule malfunctions.
• Support IR teams with deep-dive KQL investigations and platform-level forensics.

• Continuously monitor Sentinel health, connector stability, ingestion latency, and automation performance.
• Conduct regular platform audits and enforce configuration compliance.
• Maintain dashboards for platform KPIs and operational maturity.

• Create and maintain engineering runbooks, platform architecture diagrams, and standard operating procedures.
• Mentor L1/L2 SOC analysts and provide technical knowledge sessions.
• Participate in change management, risk assessments, and security architecture reviews.

• Expert-level hands-on experience with Microsoft Sentinel (minimum 4-6 years).
• Strong proficiency in KQL, including performance tuning and complex query building.
• Deep understanding of:
  • Log Analytics Workspaces
  • Azure Monitor Agent (AMA)
  • Sentinel Analytics, Workbooks, Watchlists
  • Logic Apps / SOAR automation
  • REST API integration
  • ASIM & Schema Mapping
• Knowledge of security frameworks: MITRE ATT&CK, NIST CSF, ISO 27001.
• Experience with Windows, Linux, network logs, firewalls, proxies, identity systems (AD/AAD).
• Strong debugging skills in ingestion issues, schema mismatches, parsing/normalization.