Every agent you switch on is one more thing your security team has to watch.
FERG Search is a specialist recruiter for Microsoft security operations in Australia and New Zealand, permanent and contract: Microsoft Sentinel and Defender XDR engineers, detection engineers, security operations leads and the managed security teams that run them for clients. Every search is run by the founder, Fintan Ferguson.
Microsoft partners are selling managed security alongside AI, and businesses that run Microsoft are moving more of their monitoring onto Sentinel and Defender. The people who can write the detections, tune out the noise and lead an incident at three in the morning are a small group, and the same names come up on every brief.
First shortlist within 48 hours of an agreed brief.
The people who watch the estate.
- Microsoft Sentinel engineers and architects.
- Defender XDR engineers across endpoint, identity, email and cloud apps.
- Detection engineers who write and tune KQL queries and analytics rules.
- Security operations analysts and leads for managed security services.
- Heads of managed security and security service delivery managers.
Checked technically and commercially, before you meet them.
- The detections they wrote, and how many false alarms they removed.
- The incident they led, from the first alert to the report afterwards.
- How they keep Sentinel ingestion cost under control.
- Whether they have run security as a service for clients, with service levels to meet.
What the seat pays.
Security operations briefs stall when the seat is budgeted as a monitoring analyst and the job is engineering the detections.
Security operations bands are not in the first edition of the FERG Search Salary Guide. Until then, ask: we will give you the band we are seeing accepted, declined and countered for the seat you are briefing.
Managed security is the new recurring revenue.
Partners that are becoming AI partners want to run AI, data and security for clients on a monthly fee, and security is the part clients cannot go without. That puts experienced Sentinel and Defender people in demand from partners and from the businesses they serve at the same time.
Straight answers on security operations.
Who recruits Microsoft Sentinel and Defender engineers in Australia and New Zealand?
FERG Search recruits Microsoft Sentinel and Defender XDR engineers, detection engineers and security operations leads for Microsoft partners and end users across Australia and New Zealand, permanent and contract. The founder, Fintan Ferguson, runs every search from Melbourne.
What is the difference between a security architect and a security operations engineer?
The security architect designs the controls: identity, data protection and how the estate is monitored. The security operations engineer runs them day to day: writes the detections, triages alerts and leads the response when something happens. Most teams need the architect first and the operations engineers once monitoring is live.
Do you recruit for managed security services?
Yes. Security operations analysts and leads, detection engineers, and heads of managed security for Microsoft partners that run security for their clients, permanent and contract.
Does a Sentinel engineer need KQL?
For anyone writing detections or hunting threats, yes. KQL is the query language behind Sentinel and Defender, and it is the first thing we test: a query they wrote, what it caught and what it missed.
Brief a security operations role.
Tell us what you monitor today, who is on call, and what keeps getting missed.