• Threat Detection & Response
  • Develop and fine-tune Microsoft Sentinel analytics rules, workbooks, hunting queries, and playbooks.
  • Integrate Microsoft Defender products (Defender for Endpoint, Identity, Cloud Apps, Office 365, etc.) into SIEM & SOAR platforms.
  • Mentor and guide Security Analysts on monitoring, analysis, and response to security alerts and incidents using Microsoft Defender and others security tools
  • Mentor and guide Security Analysts conduct threat hunting across the Microsoft ecosystem using KQL and other tools.
• Engineering & Integration
  • Help design and implement end-to-end security monitoring solutions using Microsoft security tools.
  • Automate response actions using Sentinel Playbooks (Logic Apps), Defender APIs, Service Now, and other security tools.
  • Ensure telemetry from endpoints, identities, email, cloud workloads, and third-party sources is normalized and ingested properly into SIEM.
  • Collaborate with IT and cloud engineering teams to ensure Microsoft security tools are correctly deployed and configured.
  • Contribute to the development of security baselines for Microsoft 365, Azure, and hybrid environments.
• Continuous Improvement
  • Stay current with evolving threats, vulnerabilities, and Microsoft product developments.
  • Evaluate and implement new features within Microsoft Defender and Sentinel to enhance detection and response.
  • Provide knowledge sharing and mentorship to junior analysts and engineers.

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or related field - or equivalent practical experience.
• 3+ years of experience in cybersecurity with a focus on Microsoft security technologies.
• Strong hands-on experience with:
  • Microsoft Sentinel (KQL, workbooks, playbooks, analytics rules)
  • Microsoft Defender XDR suite (Defender for Endpoint, Identity, Cloud Apps, Office 365)
  • Microsoft 365 Defender
  • Azure Security Center
  • PowerShell
• Proficiency in Kusto Query Language (KQL) for threat hunting and custom detection creation.
• Experience with security incident response, SIEM/SOAR processes, and threat intelligence application.
• Familiarity with MITRE ATT&CK, Zero Trust principles, and NIST cybersecurity frameworks.

• Microsoft certifications such as:
  • SC-200: Microsoft Security Operations Analyst
  • SC-100: Microsoft Cybersecurity Architect
  • AZ-500: Microsoft Azure Security Engineer
• Experience with Service Now, Service Now Security Operations, PowerShell, Logic Apps, and API integrations for automation.
• Familiarity with Microsoft Purview, Entra ID (Azure AD), and Defender for Cloud.
• Experience in hybrid environments (on-prem + Azure/M365).
• Knowledge of other security tools (ArcSight, Proxy, Splunk, etc.) is a plus.

To apply please click on APPLY TO THIS POSITION