Senior Consultant - Microsoft Sentinel and Defender Engineer in Calgary

At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.

The opportunity

EY is seeking a senior, hands‑on Microsoft security engineer to support the design, implementation, and continuous improvement of our Managed Detection and Response (MDR) services. You will work directly with clients and delivery teams to architect and deploy Microsoft Sentinel, engineer detections and security use cases, build automation with Azure Logic Apps, develop operational workbooks, and integrate Microsoft Defender solutions. You will also help onboard and operate customer environments through Azure Lighthouse and Microsoft Entra B2B.

Your role at a glance

Key responsibilities

• Microsoft Sentinel architecture and implementation: Lead the technical design and implementation of Microsoft Sentinel SIEM and SOAR solutions for new and existing MDR clients.
• Detection engineering and threat analytics: Create, test, tune, document, and maintain analytics rules, hunting queries, parsers, and functions using Kusto Query Language (KQL).
• Automation, orchestration, and reporting: Design, build, secure, and troubleshoot Microsoft Sentinel automation rules and playbooks using Azure Logic Apps.
• Multi-tenant onboarding and engineering: Design and implement secure cross-tenant access using Azure Lighthouse and Microsoft Entra B2B collaboration.
• MDR service engineering and client collaboration: Provide senior technical support for incident investigation, threat hunting, detection tuning, platform health, and continuous service improvement.

Skills and attributes for success

• Substantial hands‑on experience designing, implementing, and operating Microsoft Sentinel in enterprise or managed-service environments.
• Advanced KQL skills and demonstrated experience developing analytics rules, hunting queries, functions, parsers, workbooks, and detection content.
• Strong experience with Microsoft Defender XDR, including relevant Defender products across endpoints, identity, email and collaboration, cloud apps, and cloud workloads.
• Hands‑on experience building Azure Logic Apps, Microsoft Sentinel playbooks, and automation rules.
• Experience architecting Microsoft Sentinel deployments, including workspace strategy, data connectors, ingestion and retention, role‑based access control, and operational cost management.

Qualifications

• Bachelor’s degree or diploma in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
• Typically, seven or more years of cybersecurity experience, including significant recent experience delivering Microsoft Sentinel and Defender engineering work.
• Experience working in a client‑facing consulting, MSSP, MDR, or enterprise security engineering role.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) is preferred.

What we offer

At EY, our Total Rewards package supports our commitment to creating a leading people culture - built on high-performance teaming - where everyone can achieve their potential and contribute to building a better working world for our people, our clients and our communities.

Inclusiveness at EY

Inclusiveness is at the heart of who we are and how we work. We’re committed to fostering an environment where differences are valued, policies and practices are equitable, and our people feel a sense of belonging.