Microsoft Security Engineer

Role Purpose

The Microsoft Security Engineer will be responsible for day-to-day administration, monitoring, support, and optimization of Microsoft security technologies within the customer environment. The role covers Identity & Access Security, Endpoint Security, Email & Collaboration Security, Cloud & SaaS Security, and Data Protection controls across the Microsoft ecosystem.

The engineer will provide operational support, investigate alerts, recommend and implement approved changes, maintain documentation, and support continuous improvement of the customer’s Microsoft security posture in line with agreed service scope and change management processes.

Key Responsibilities

1. Identity & Access Security

• Support and administer Microsoft Entra ID security controls.
• Monitor and review MFA, Conditional Access, sign-in events, and identity-related risks.
• Support Privileged Identity Management activities and privileged role governance processes.
• Assist with access reviews, role review activities, and identity security hygiene improvements.
• Investigate suspicious login activity, risky users, and anomalous authentication patterns.

2. Endpoint Security

• Monitor and manage Microsoft Defender for Endpoint alerts where deployed.
• Perform initial triage, investigation, and coordination for endpoint-related incidents.
• Recommend and implement approved policy tuning to reduce false positives and improve detection quality.
• Coordinate with customer stakeholders for endpoint isolation, containment, and remediation actions where delegated.
• Track endpoint security posture improvements and recurring security issues.

3. Email & Collaboration Security

• Monitor and handle alerts from Microsoft Defender for Office 365.
• Investigate phishing, spam, malware, suspicious email, and BEC-related incidents.
• Support quarantine review, message analysis, user-reported phishing workflows, and submission processes.
• Assist in tuning anti-phishing, anti-spam, safe links, and safe attachments policies where delegated.
• Coordinate with customer teams on email-related incident response and user impact assessment.

4. Cloud & SaaS Security

• Monitor and investigate alerts from Microsoft Defender for Cloud and Defender for Cloud Apps where enabled.
• Review exposed risks, misconfigurations, suspicious cloud activity, and SaaS security alerts.
• Support secure score review and track remediation/improvement initiatives.
• Provide recommendations to improve cloud security posture and reduce exposure.

5. Data Protection & Compliance Support

• Support Purview audit visibility and investigation of relevant audit events.
• Monitor DLP alerts and assist in tuning DLP policies where enabled and delegated.
• Review data protection trends, policy hits, and recurring false positives.
• Support reporting and evidence gathering related to security and compliance operations.

BAU / Operational Activities

• Handle service requests related to Microsoft security administration within agreed guardrails.
• Perform approved configuration changes such as policy adjustments, onboarding of users/groups/domains, and security configuration updates.
• Maintain operational documentation, change records, implementation notes, and runbooks.
• Participate in peer review and controlled deployment during agreed change windows.
• Prepare monthly operational reports covering alerts, incidents, trends, posture changes, tuning activities, and improvement backlog.
• Conduct monthly secure score reviews and support quarterly roadmap discussions.
• Continuously identify opportunities for optimization, false-positive reduction, and security maturity improvement.

Required Skills & Experience

Hands-on experience with Microsoft Entra ID, Conditional Access, MFA, and PIM.

Experience with Microsoft Defender for Endpoint.

Experience with Microsoft Defender for Office 365, including phishing and BEC investigations.

• Familiarity with Microsoft Defender for Cloud, Defender for Cloud Apps, and Microsoft Purview.
• Experience in alert investigation, incident handling, policy tuning, and operational security support.
• Good understanding of Microsoft 365 security architecture and administrative controls.
• Experience in change management, documentation, and customer-facing support activities.
• Ability to coordinate with customer IT, security, and compliance teams.

Preferred Qualifications

Microsoft security certifications such as:

• Microsoft Certified: Security Operations Analyst Associate
• Microsoft Certified: Identity and Access Administrator Associate
• Microsoft Certified: Cybersecurity Architect Expert
• Microsoft 365 / Azure security-related certifications

Job Type: Full-time

Application Question(s):

• Salary Expectations

Experience:

• Security Operations : 3 years (Required)

Work Location: In person