Job DescriptionWhat you'll bringYou're a senior security engineer with expert-level Microsoft Sentinel skills, a strong background in Infrastructure as Code, and deep experience in security telemetry engineering.
- Hands-on Microsoft Sentinel and enterprise SIEM engineering experience, including deployment, administration, monitoring, incident management, detection engineering, and advanced KQL
- Strong Infrastructure as Code and CI/CD expertise using Terraform, Bicep/ARM, Git, and Azure DevOps/GitHub/Jenkins to deliver secure, version-controlled Sentinel and Azure environments
- Experience in automation and AI engineering, with proficiency in Python and TypeScript/Node.js or Go, and hands-on experience developing AI solutions, MCP integrations, API-driven automation, and process optimisation
- Proven experience designing and operating Cribl Stream or Edge pipelines for large-scale security telemetry
- Degree not required for this role.
- Relevant certifications are an advantage - Microsoft SC-200 (Security Operations Analyst), AZ-500 (Azure Security Engineer), AZ-104, or Cribl Certified Admin.
We also look for people who build trust naturally, communicate with clarity, keep the customer at the centre of what they do, and bring emotional intelligence and genuine problem-solving ability to the challenges they face.
In addition to the skills and experience needed for this role, all positions at SAP require candidates to be comfortable using AI tools. This includes using agentic AI for daily tasks such as creating effective inputs, automating routine tasks, and judging the quality of AI-generated outputs. Candidates should also promote the use of AI practices within their teams.
What you'll buildYou will own Sentinel platform engineering end-to-end and lead the design of SAP's enterprise SIEM, data pipeline, and AI integration ecosystem.
- Engineer and optimise Microsoft Sentinel and Log Analytics workspaces across availability, performance, cost, and access control
- Build and operate Cribl pipelines to collect, transform, and route security telemetry to Sentinel, Splunk, and data lakes
- Design and implement MCP servers that expose Sentinel and Splunk APIs with RBAC, schema validation, rate limiting, and full audit trails
- Manage all SIEM, pipeline, and AI configurations as code, with drift detection and compliance-as-code enforcement
- Integrate AI and MCP capabilities with SOC co-pilots for detection triage, alert investigation, and response workflows
Where you belongSAP Global Security & Cloud Compliance protects SAP's enterprise environment and ensures compliance with global security standards. The SIEM engineering function builds the telemetry and detection infrastructure the SOC depends on, working at the intersection of cloud security, AI, and platform engineering. This is a hands-on ownership role in a modern, AI-enabled Sentinel environment at enterprise scale.
QualificationsAdditional InformationAll your information will be kept confidential according to EEO guidelines.
Compensation Range Transparency
SAP believes pay transparency is essential to fostering an honest, supportive, and inclusive culture and is an important part of our commitment to pay equity. The salary range for this position is included in the job posting. The actual compensation offered to the successful candidate will fall within that range and will depend on factors such as education, skills, experience, location, and scope of the role, as determined through the selection process. Where applicable, SAP may also provide variable incentive opportunities and additional benefits, subject to the terms of the relevant plans and policies. Any variable incentive amount is target-based, with actual payouts dependent on company and individual performance. Please reference this link for a summary of SAP benefits and eligibility requirements: SAP North America Benefits.
AI Usage in the Recruitment Process
For information on the responsible use of AI in our recruitment process, please refer to our Guidelines for Ethical Usage of AI in the Recruiting Process.
Please note that any violation of these guidelines may result in disqualification from the hiring process.
