Microsoft Defender/Sentinel Admin

Position Summary
We are seeking an experienced Microsoft Defender & Sentinel Administrator to lead the
configuration, monitoring, and optimization of our security operations platform. In this role, you will
manage our SIEM (Security Information and Event Management), Extended Detection and
Response (XDR), and automated security orchestration workflows to protect our enterprise
infrastructure against sophisticated cyber threats.
Key Responsibilities
Microsoft Defender Administration
• Threat Protection: Administer and optimize Microsoft Defender XDR components, including
Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for
Cloud Apps.
• Vulnerability Management: Monitor endpoint health, assess software vulnerabilities, and
enforce security baselines across multi-platform endpoints (Windows, macOS, Linux,
mobile).
• Incident Triage: Investigate high-priority security alerts, analyze threat vectors, and execute
containment or remediation steps.
Microsoft Sentinel Operations
• Workspace Management: Administer Microsoft Sentinel workspaces, configure data
connectors, and ensure the seamless ingestion of logs from Azure, M365, and third-party
sources.
• Detection Engineering: Create, test, and tune analytics rules, hunting queries, and parsers
using Kusto Query Language (KQL) mapped to the MITRE ATT&CK framework.
• Threat Proactivity: Conduct proactive threat hunting to uncover hidden anomalous activity
across identity, cloud, and network telemetry.
Automation & Orchestration
• Playbook Development: Design, build, and troubleshoot automation rules and security
playbooks using Azure Logic Apps.
• Workflow Efficiency: Automate incident enrichment, triage notifications, ticket creation, and
standard containment responses to reduce Mean Time to Respond (MTTR).
Qualifications & Skills
• Experience: 5+ years of hands-on experience in cybersecurity administration, security
operations (SOC), or cloud infrastructure security.
• Technical Expertise:
◦ Deep knowledge of Microsoft Defender security suite and Microsoft Sentinel.
◦ Proficiency in Kusto Query Language (KQL) for log analysis and threat hunting.
◦ Experience building Azure Logic Apps and security playbooks.
◦ Familiarity with Microsoft Entra ID (Azure AD) and Microsoft Intune
◦ Must be familiar with Authorization protocal, MFA and conduction access.