Microsoft Defender Security Engineer L3
VaporVM
Role:We are seeking an experienced Microsoft Defender Security Engineer L3 to manage, administer, configure, and optimize Microsoft’s advanced security platforms. The ideal candidate will have strong hands-on expertise across Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Servers, and Defender for Cloud Apps. The role involves advanced security administration, threat detection, incident investigation, KQL-based threat hunting, security engineering, and integration with enterprise SIEM and SOAR platforms.
Key Responsibilities
Platform Administration: Onboard and maintain devices, servers, sensors, and integrations across Microsoft Defender workloads. Manage security configurations, access controls, and platform health.
Security Configuration & Engineering: Implement, configure, and optimize security policies, endpoint protection, attack surface reduction, email security, identity protection, and cloud application controls.
L3 Security Monitoring & Incident Response: Investigate and resolve escalated security incidents, perform root cause analysis, conduct KQL-based threat hunting, and coordinate authorized containment and remediation activities with the MSSP SOC.
Detection Engineering & KQL: Develop, maintain, and optimize KQL queries, detection use cases, hunting queries, and custom detection rules across Defender XDR, MDI, and MDO.
SIEM & SOAR Integration: Integrate Microsoft Defender with IBM QRadar SIEM, Trend Micro endpoint security, and SOAR platforms. Manage log-source onboarding, alert and incident forwarding, automated playbooks, and ITSM workflows.
Automation & Security Copilot: Leverage Microsoft Security Copilot to support security triage, investigation, threat enrichment, and automated response workflows.
Cross-Functional Collaboration: Coordinate with endpoint, server, identity, messaging, cloud, and application teams to address security gaps, troubleshoot agent and sensor issues, and implement approved changes.
Documentation & Reporting: Maintain operational playbooks, configuration baselines, audit evidence, and technical documentation. Provide weekly task updates and monthly reports covering security coverage, platform health, incidents, tuning activities, and identified risks.
Required Qualifications & Skills
Bachelor's degree in Engineering, preferably Computer, Information Technology, Electronics, or a related discipline.
5–6 years of relevant cybersecurity experience, with hands-on administration, configuration, monitoring, and investigation across Microsoft Defender security workloads.
Strong practical experience with:
Microsoft Defender XDR
Microsoft Defender for Endpoint (MDE)
Microsoft Defender for Office 365 (MDO)
Microsoft Defender for Identity (MDI)
Microsoft Defender for Servers
Microsoft Defender for Cloud Apps (MDCA)
Proven experience integrating and operating IBM QRadar SIEM, Trend Micro endpoint security, and SOAR platforms with Microsoft Defender.
Hands-on expertise in log-source onboarding, alert and incident forwarding, automated playbooks, and ITSM workflows.
Strong proficiency in Kusto Query Language (KQL) and PowerShell for threat hunting, detection engineering, investigation, and automation.
Practical knowledge of Windows/Linux security, Microsoft Entra ID, Active Directory, Exchange Online, incident response, and enterprise SIEM/ITSM integrations.
Ability to troubleshoot complex security issues, optimize detection capabilities, and collaborate with SOC and infrastructure teams.
Preferred Certification
Microsoft Certified: Security Operations Analyst Associate (SC-200)