M365 E5 Security Administration & Engineering

Job Description

As a M365 E5 Security Administration & Engineering professional, you will be responsible for configuring and maintaining Conditional Access policies, Multi-Factor Authentication (MFA), Privileged Identity Management (PIM), and Identity Protection rules using Identity & Access (Entra ID). You will also oversee Safe Links, Safe Attachments, anti-phishing, anti-spam policies, and quarantine triage using Email & Collaboration (Defender for Office 365). Additionally, you will implement and monitor Data Loss Prevention (DLP) policies, Sensitivity Labels, and Information Barrier policies across M365 services using Data Protection & Governance (Purview). Furthermore, you will monitor shadow IT, manage OAuth app permissions, and enforce session policies using Cloud Apps (Defender for Cloud Apps). You will also maintain and optimize log ingestion from M365, Entra ID, Defender XDR, firewalls, and cloud infrastructure while keeping ingestion costs efficient using Data Connector Management. You will write and update KQL (Kusto Query Language) analytics rules, hunting queries, and custom workbooks/dashboards using Detection & Analytics. You will also build and maintain Logic Apps playbooks to automate incident response workflows and threat containment using Automation (SOAR). Finally, you will perform Tier 2/3 triage, investigation, and root-cause analysis on alerts originating from Defender XDR and Sentinel using Incident Response.

Requirements

• 3+ years of hands-on experience administering Microsoft 365 security features, specifically within an E5 / Defender XDR environment.
• 3+ years of experience configuring and operating Microsoft Sentinel.
• Strong proficiency in writing KQL (Kusto Query Language) queries for logs, investigations, and analytics rules.
• Experience with Microsoft Intune (MDM/MAM) for Windows endpoint management.
• Solid understanding of PowerShell for M365 scripting and security automation.
• Hands-on knowledge of networking basics (DNS, Firewalls, VPNs) and cloud identity fundamentals (Entra ID, SAML, SSO).