Configure and manage cloud-native security solutions such as Microsoft Defender for Cloud, Microsoft Entra ID, Conditional Access, and workload protection services.
Perform cloud security assessments, identify risks, and recommend remediation strategies.
Partner with infrastructure and application teams to support secure cloud adoption and architecture reviews.
Endpoint Security
Administer and optimize enterprise endpoint protection and EDR/XDR platforms, including Microsoft Defender for Endpoint or equivalent solutions.
Develop and maintain endpoint security policies covering malware protection, device control, attack surface reduction, and endpoint hardening.
Investigate endpoint security events, coordinate remediation efforts, and improve overall endpoint security posture.
Email Security
Manage enterprise email security platforms, including Microsoft Defender for Office 365 or comparable secure email gateways.
Configure and maintain email protection technologies, including anti-phishing, anti-malware, Safe Links, Safe Attachments, SPF, DKIM, and DMARC.
Investigate email-based threats and phishing campaigns while continuously enhancing email security controls.
Vulnerability Management
Administer enterprise vulnerability management platforms such as Microsoft Defender Vulnerability Management, Tenable, Qualys, or Nessus.
Conduct vulnerability assessments, validate remediation activities, and prioritize findings based on business risk and exploitability.
Produce vulnerability metrics, dashboards, and executive-level reporting.
Collaborate with infrastructure, cloud, and application teams to ensure timely remediation of identified vulnerabilities.
SIEM, Threat Detection & Security Monitoring
Configure, maintain, and optimize SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or equivalent technologies.
Develop and tune detection rules, analytics, KQL queries, dashboards, workbooks, and threat detection use cases.
Integrate security telemetry from cloud, identity, endpoint, network, and application sources.
Support security incident investigations, threat hunting, and forensic analysis activities.
Develop and maintain automation and orchestration workflows using SOAR technologies to improve operational efficiency and incident response.
Collaboration & Continuous Improvement
Collaborate with cross-functional IT, infrastructure, cloud, and application teams to implement secure solutions and drive security initiatives.
Identify opportunities to automate security operations, improve processes, and enhance platform performance.
Stay current with emerging cybersecurity threats, technologies, and industry best practices, recommending improvements to strengthen the organization's security posture.
Required Qualifications
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
6–10 years of experience in Information Security, Cybersecurity Engineering, or a related security engineering role.
Strong experience designing, implementing, and supporting enterprise security solutions within Microsoft-centric environments.
Hands-on experience across multiple security domains, including cloud security, endpoint security, email security, vulnerability management, and SIEM/SOAR platforms.
Experience with scripting and automation using PowerShell, Python, or similar languages.
Solid understanding of networking, operating systems, identity and access management, authentication protocols, and security architecture principles.
Experience integrating security solutions using REST APIs, Microsoft Graph API, or other enterprise integration technologies.
Strong analytical, troubleshooting, and problem-solving skills with the ability to manage complex technical issues.
Excellent written and verbal communication skills with the ability to collaborate effectively across technical and business teams.
Preferred Certifications
Candidates with one or more of the following Microsoft certifications are preferred:
Microsoft Certified: Cybersecurity Architect Expert (SC-100)
Microsoft Certified: Security Operations Analyst Associate (SC-200)
Microsoft Certified: Identity and Access Administrator Associate (SC-300)
Microsoft Certified: Information Protection Administrator Associate (SC-400)
Microsoft Certified: Azure Security Engineer Associate (AZ-500)
Preferred Technical Skills
Experience with one or more of the following technologies is highly desirable:
Microsoft Security
Microsoft Sentinel
Microsoft Defender XDR
Microsoft Defender for Endpoint
Microsoft Defender for Office 365
Microsoft Defender for Cloud
Microsoft Entra ID
Microsoft Purview
Microsoft Intune
Cloud Security
Microsoft Azure Security
AWS Security Services
Google Cloud Security
Security Operations & Automation
SIEM/SOAR platforms
Kusto Query Language (KQL)
PowerShell
Python
Azure Logic Apps
Microsoft Graph API
REST APIs
Vulnerability Management & Frameworks
Microsoft Defender Vulnerability Management (MDVM)
Qualys
Tenable
Nessus
MITRE ATT&CK Framework
NIST Cybersecurity Framework
