Senior Information Security Engineer

Berkley Technology Services LLC
Berkley Technology Services LLC provides technology solutions and services in support of the broader W. R. Berkley Corporation enterprise, delivering secure, reliable, and scalable platforms that enable business operations and innovation across the organization.

The Company is an equal employment opportunity employer.

The Senior Information Security Engineer is responsible for leading the engineering and enhancement of the Microsoft Sentinel SIEM platform, designing and supporting security data ingestion and automation, implementing Azure and cloud security controls, and collaborating with cross-functional teams to strengthen the organization’s security posture.

This role will:

• Lead the engineering, deployment, administration, and continuous enhancement of Microsoft Sentinel as the organization’s enterprise SIEM platform, including workspace architecture, RBAC, retention management, and ingestion cost optimization.
  • Design, build, maintain, and troubleshoot security data ingestion pipelines and Sentinel connectors using Azure Monitor Agent, Data Collection Rules, CEF/Syslog, APIs, Event Hubs, Azure Functions, Logic Apps, and custom integration patterns.
  • Validate and troubleshoot ingested data using KQL and other tools, resolving data quality, schema, parsing, normalization, latency, performance, and ingestion reliability issues.
  • Engineer and support log routing, filtering, parsing, and transformation through Cribl, including troubleshooting upstream ingestion issues and onboarding new data sources into Sentinel.
  • Establish scalable and supportable patterns for onboarding security telemetry from on-premises, cloud, SaaS, and third-party platforms, including automated monitoring and validation of ingestion pipelines.
  • Apply engineering best practices to Sentinel configurations and content, including source control, testing, peer review, CI/CD deployment, technical documentation, and lifecycle management.
  • Proactively identify routine, repeatable, and manual tasks across security engineering platforms and develop automations that reduce operational effort, improve consistency, and accelerate response times.
  • Design, build, and maintain security automation and orchestration solutions using Sentinel Automation Rules, Logic Apps, Azure Functions, PowerShell, Python, REST APIs, and Infrastructure as Code technologies including Bicep, ARM, and Terraform.
  • Develop and maintain detection-as-code and automation-as-code practices, integrating security content deployment into CI/CD pipelines and measuring automation outcomes including operational efficiency and time savings.
  • Design, implement, and maintain Azure security controls and security architecture standards, including Microsoft Defender for Cloud, Azure Policy, Entra ID, Conditional Access, Key Vault, network security controls, and secure landing zone architectures.
  • Translate business, regulatory, and security requirements into technical controls, monitoring requirements, and security baselines across Azure, hybrid, and on-premises environments.
  • Provide technical guidance and hands-on support to infrastructure, cloud, and application teams on secure architecture patterns, cloud security best practices, and risk mitigation strategies.
  • Design, implement, and maintain Microsoft Purview data protection capabilities including Data Loss Prevention (DLP), sensitivity labels, information protection, Insider Risk Management, and auditing solutions.
  • Prepare and maintain technical standards, procedures, security documentation, runbooks, and operational guidance supporting Sentinel, cloud security, automation, and data protection capabilities.
  • Monitor emerging threats and industry trends, translating findings into new detections, automation opportunities, and security control improvements.
  • Prepare and present project status, risks, and security initiatives to leadership, providing actionable recommendations and clear communication of technical concepts.
  • Lead and mentor junior security engineers through design reviews, technical guidance, knowledge sharing, and career development support.
  • Provide Person in Charge (PIC) coverage on a rotational basis, serving as the senior escalation point for complex security incidents and operational decisions.
  • Collaborate closely with Security Operations, Infrastructure, Cloud, DevOps, and IT teams to design, implement, and continuously improve security controls, monitoring capabilities, automation solutions, and data protection measures across the enterprise.

• 5 years’ experience as a Cloud Security Engineer, Information Security Engineer or Devsecops Engineer.
• 5 years’ experience with network, cloud, and computer system security, including security mechanisms such as user access controls, role-based access control, SSO, file permissions, firewall policies, and audit logs.
• 5 years’ experience in security systems, including firewalls, intrusion detection systems, endpoint protection systems, web application firewalls, vulnerability scanning software, privilege access management, data loss protection, log management, content filtering.
• 5 years’ experience in developing and deploying security solutions to defend against advanced cyber threats.
• 5 years’ experience in reviewing and monitoring security systems to ensure they are functioning properly and securely.
• 5 years’ experience with investigating intrusion incidents, conducting investigations and handling security incidents.