The Role
You will be responsible for designing, implementing, securing and supporting Microsoft security technologies across cloud, identity, endpoint, infrastructure and security monitoring platforms.
Key Responsibilities
- Act as a Subject Matter Expert for Microsoft Azure security, Microsoft Sentinel, Microsoft Defender XDR and associated Microsoft security technologies
- Design, implement and support enterprise security controls across Azure, Microsoft Entra ID and the Microsoft security ecosystem
- Engineer and maintain Microsoft Sentinel capabilities
- Design, implement and optimise Microsoft Defender capabilities
- Develop security monitoring use cases, threat detections and hunting queries aligned to business risks, threat intelligence and MITRE ATT&CK
- Design secure cloud and hybrid architecture patterns
- Engineer telemetry and logging solutions
- Design and implement security automation
- Perform technical security assessments
- Implement and maintain cloud security baselines, hardening standards, policy controls and configuration-management practices
- Support vulnerability and configuration-risk remediation
- Support cyber incident investigations
- Produce and maintain High-Level Designs, Low-Level Designs, engineering standards, operating procedures, support documentation and implementation records
- Lead platform enhancements, proof-of-concepts, migrations, upgrades, troubleshooting and service-improvement activities
- Build platform health monitoring, operational dashboards and KPI/KRI reporting
Essential Experience
- Proven Azure security engineering experience within a large, complex enterprise environment
- Strong hands-on experience implementing and supporting Azure security services across IaaS, PaaS and hybrid environments
- Practical experience with Microsoft Entra ID security, including Conditional Access, Privileged Identity Management, Identity Protection and hybrid identity controls
- Strong experience with Microsoft Sentinel and Microsoft Defender XDR, including Endpoint, Identity, Cloud and Office 365 security capabilities
- Experience designing and implementing cloud security architecture, platform hardening, technical security controls and security baselines
- Experience onboarding and validating infrastructure, cloud, application, identity and security telemetry
- Experience developing KQL queries, analytics rules, workbooks, automation and threat-hunting content
- Experience conducting technical risk assessments, security-control validation and vulnerability-remediation support
- Experience with REST APIs, PowerShell, Python, automation, enterprise troubleshooting and operational support
- Experience working with Security Operations, Incident Response, Cloud, Infrastructure, Identity and Architecture teams
Technical Skills
- Azure Policy
- Defender for Cloud
- Azure Monitor
- Log Analytics
- Azure Arc
- Key Vault
- Managed Identities
- Role-Based Access Control
- Landing-Zone Security
- Cloud Security Posture Management
- Virtual Networks
- Network Security Groups
- Azure Firewall
- Private Endpoints
- Private Link
- Microsoft Entra ID
- Conditional Access
- Privileged Identity Management
- Identity Protection
- Authentication
- Access Control
- Federation
- Identity Governance
- Microsoft Sentinel
- Defender XDR
- Defender for Endpoint
- Defender for Identity
- Defender for Office 365
- Defender for Cloud
- KQL
- Analytics Rules
- Hunting Queries
- Workbooks
- Data Connectors
- Data Collection Rules
- Watchlists
- Automation Rules
- Playbooks
- Logic Apps
- Azure Functions
- REST APIs
- PowerShell
- Python
- Azure DevOps
- Git
- CI/CD
- Infrastructure-as-Code Concepts
- Security Architecture
- Technical Risk Assessment
- Platform Hardening
- Vulnerability Remediation
- Control Validation
- Secure Development Practices
- Operational Readiness
Desirable Experience
- Experience securing Azure landing zones and enterprise-scale cloud platforms
- Experience with Security Orchestration, Automation and Response solutions and automated control validation
- Experience with Privileged Access Management and Zero Trust security principles
- Experience supporting security platforms in a regulated financial-services environment
- Exposure to multi-cloud or hybrid-cloud environments, including AWS or GCP
Qualifications
- Degree or equivalent professional experience in Information Technology, Cyber Security, Engineering or a related discipline
- AZ-500 and SC-200 certifications strongly preferred
- SC-100, SC-300 or AZ-104 certifications desirable
- CISSP, CCSP or relevant GIAC qualifications advantageous
Rate:
£550/day
Location:
London
IR35 Status:
Outside
Remote Status:
Hybrid
Industry:
Cybersecurity
Seniority Level:
Senior