Microsoft Defender & Sentinel Administrator

Lead the configuration, monitoring, and optimization of our security operations platform. In this role, you will manage our SIEM (Security Information and Event Management), Extended Detection and Response (XDR), and automated security orchestration workflows to protect our enterprise infrastructure against sophisticated cyber threats.

Microsoft Defender Administration

• Threat Protection: Administer and optimize Microsoft Defender XDR components, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps.
• Vulnerability Management: Monitor endpoint health, assess software vulnerabilities, and enforce security baselines across multi-platform endpoints (Windows, macOS, Linux, mobile).
• Incident Triage: Investigate high-priority security alerts, analyze threat vectors, and execute containment or remediation steps.

Microsoft Sentinel Operations

• Workspace Management: Administer Microsoft Sentinel workspaces, configure data connectors, and ensure the seamless ingestion of logs from Azure, M365, and third-party sources.
• Detection Engineering: Create, test, and tune analytics rules, hunting queries, and parsers using Kusto Query Language (KQL) mapped to the MITRE ATT&CK framework.
• Threat Proactivity: Conduct proactive threat hunting to uncover hidden anomalous activity across identity, cloud, and network telemetry.

Automation & Orchestration

• Playbook Development: Design, build, and troubleshoot automation rules and security playbooks using Azure Logic Apps.
• Workflow Efficiency: Automate incident enrichment, triage notifications, ticket creation, and standard containment responses to reduce Mean Time to Respond (MTTR).

Qualifications & Skills

• Experience: 5+ years of hands-on experience in cybersecurity administration, security operations (SOC), or cloud infrastructure security.
• Technical Expertise:
• Deep knowledge of Microsoft Defender security suite and Microsoft Sentinel.
• Proficiency in Kusto Query Language (KQL) for log analysis and threat hunting.
• Experience building Azure Logic Apps and security playbooks.
• Familiarity with Microsoft Entra ID (Azure AD) and Microsoft Intune
• Must be familiar with Authorization protocol, MFA and conduction access.