Accountabilities
Lead enterprise security implementations:Design, architect, deploy, configure, and optimize Microsoft Sentinel and Defender XDR solutions for large and enterprise-level customers, ensuring effective integration and alignment with security objectives.
Develop advanced detection capabilities:Create and refine detection rules, automation workflows, reporting use cases, and security analytics based on customer requirements and emerging threats.
Assess and improve security maturity:Evaluate clients' SIEM and XDR deployments, identify gaps, recommend improvements, and implement strategies to strengthen security monitoring and response capabilities.
Build security reporting solutions:Design and support operational dashboards and executive-level reports that provide clear visibility into security performance, threat activity, and operational effectiveness.
Drive cloud security integration:Lead integrations across Microsoft Security and Azure technologies, applying Microsoft XDR principles and Zero Trust Architecture practices to improve protection across enterprise environments.
Provide technical leadership:Serve as the primary technical delivery lead for complex customer projects, coordinate engineering activities, and guide implementation decisions from planning through execution.
Mentor and develop engineers:Support junior and mid-level team members through technical guidance, knowledge sharing, code and configuration reviews, and the promotion of engineering best practices.
Improve delivery processes:Contribute to research and development initiatives, identify opportunities to enhance technical enablement, and help develop new security features and service capabilities.
Support ongoing security operations:Work with customer environments to continuously improve and maintain Managed Detection and Response practices, ensuring solutions remain effective as requirements evolve.
Document and share expertise:Create internal technical documentation, participate in knowledge-sharing sessions, contribute to team learning initiatives, and develop technical content for external audiences when appropriate.
Collaborate with stakeholders:Communicate effectively with customers and internal teams, translate technical requirements into actionable solutions, and ensure successful delivery of security engineering projects.Requirements
Professional experience:At least 8 years of technical experience implementing or enabling cybersecurity technologies, particularly Microsoft Cloud Security solutions or equivalent SIEM and XDR platforms.
Microsoft Sentinel expertise:Extensive hands-on experience deploying, configuring, managing, and optimizing Microsoft Sentinel in production environments.
Microsoft Defender experience:Strong practical experience implementing and managing Microsoft Defender security products, including Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, and Defender for Cloud.
Enterprise security engineering:Demonstrated experience engineering and maintaining SIEM and/or XDR solutions in complex enterprise production environments.
Azure cloud knowledge:Strong understanding of Azure cloud services and their application to enterprise security architectures and integrations.
Querying and scripting:Experience with query languages and scripting technologies such as Kusto Query Language (KQL), SPL, SQL, PowerShell, or comparable tools.
Cybersecurity fundamentals:Solid understanding of enterprise IT systems, security monitoring, threat detection, and the relationship between infrastructure and cybersecurity.
Security architecture:Familiarity with Microsoft XDR capabilities and Zero Trust Architecture principles, including their application to enterprise security environments.
Communication and collaboration:Excellent written and verbal communication skills, with the ability to explain complex technical concepts and collaborate effectively with customers and cross-functional teams.
Leadership and problem-solving:Ability to lead complex technical projects, mentor engineers, make sound architectural decisions, and thrive in a dynamic, fast-paced environment.
Education and certifications:A bachelor's degree in a relevant field or equivalent professional experience and certifications. Microsoft certifications such as SC-200 and AZ-500 are advantageous.Additional qualifications that are a plus:
Advanced KQL expertise, including Microsoft Sentinel analytics rules and Defender custom detection rules.Experience with Azure Logic Apps, Azure Function Apps, and related cloud automation technologies.Knowledge of Microsoft 365 productivity platforms, including Exchange Online, Microsoft Teams, and SharePoint.Experience administering Microsoft Intune.Previous experience in customer-facing security engineering or technical consulting roles.Practical incident investigation and incident response experience.Programming proficiency in Python, PowerShell, or C#/.NET.Familiarity with Linux configuration and common system administration tasks.Additional eligibility requirement:Candidates must be U.S. citizens and authorized to work in the United States. Citizenship verification may be required for assignments involving certain federal contracts.
Benefits
Competitive compensation:Competitive salary and a comprehensive benefits package. The specific salary range for this position was not disclosed in the original job description.
Remote work:Fully remote position based in the United States.
Professional development:Opportunities to deepen expertise in Microsoft Sentinel, Defender XDR, Azure, enterprise security architecture, and advanced threat detection.
Technical leadership:Opportunities to mentor engineers, influence engineering standards, and lead complex enterprise cybersecurity deployments.
Meaningful impact:Contribute to protecting organizations against evolving cyber threats and improving their ability to detect, investigate, and respond to security incidents.
Collaborative environment:Work alongside cybersecurity professionals and technical specialists in a global, mission-driven organization.
Career growth:Support for continued professional development, knowledge sharing, and advancement in cybersecurity engineering.
Employee wellbeing:Access to a comprehensive benefits package designed to support employee wellbeing and long-term career growth.