Position: Senior Kusto KQL Developer
Company: ITernal Group
Category: Other
Experience required: 5y
English level: upper

We are seeking a highly skilled Senior Kusto KQL Developer with a deep understanding of regular expressions to join our team. The successful candidate will be responsible for designing, developing and implementing Kusto query-based solutions to meet customer requirements.

**Responsibilities:**
· Developing new custom Microsoft Sentinel Analytic Rules based on customer requirements
· Onboard unstructured log sources by developing custom parsers, utilising various log collection methods
· Create custom Update Polices leveraging KQL and Regex
· Optimize queries to improve performance and efficiency whilst adhering to Microsoft best practices
· Develop and maintain playbook and investigation guidelines documentation to be used by SOC analysts
· Collaborate with cross-functional teams to understand customer requirements and recommend best practices related to Sentinel solution.
· Offer consultative advice in security principles and best practices related to Sentinel operations.
· Mentoring junior members of the team.

**Requirements:**
· 5 years’ experience in a similar role.
· Understand Sentinel components in depth.
· Strong understanding of regular expressions and their application in data manipulation and analysis
· Experience with Azure Sentinel SIEM platform.
· Strong problem-solving skills with the ability to troubleshoot and resolve complex issues
· Preferred SIEM vendor certification of administrator level.
· In-depth experience using KQL at a senior developer level.
· Experience of applying the Mitre Att&ck Framework to security Use Cases
· Familiarity with different security attack vectors and means of protection.
· Experience in the software development life cycle, Azure DevOps is a plus.

**We offer:**
· Possibility to influence the development of the project.
· Friendly, professional staff and warm atmosphere.
· Help with development via mentoring and coaching.
· The environment where you can implement your ideas.
· Plans for growth and the performance review (every 6 months).
· Flexible schedule and opportunities to work remotely (8 hours workday).
· Paid vacation and sick leaves.
· Participation in educational activities and thematic conferences;
· Team parties and corporate events.