> Markdown version of [/jobs/ext/2259705-l1-support-sme-microsoft-defender-xdr-support](https://www.wearedevelopers.com/jobs/ext/2259705-l1-support-sme-microsoft-defender-xdr-support). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# L1 Support SME - Microsoft Defender XDR Support

- **Company:** ELLIOTT MOSS CONSULTING PTE. LTD.
- **Location:** Penarth, UK
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Microsoft Windows, Microsoft Azure, Cloud Computing, Cyber Security, Issue Tracking Systems, Microsoft Security Essentials, Microsoft InTune, Azure Security Center, Information Technology
- **Published:** August 26, 2026
- **Apply:** https://www.collegerecruiter.com/job/2815088845-l1-support-sme--microsoft-defender-xdr-support

## About the Role

* Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related discipline.
 * Experience in L1 Support, Microsoft Security Operations, Endpoint Support, Service Desk Operations, or Microsoft 365 Support environments.
 * Strong understanding of incident management, ticket lifecycle management, and escalation procedures.
 * Excellent communication, documentation, and stakeholder management skills.
 * Technical Skills: Microsoft Defender for Endpoint (MDE), Microsoft Defender for Cloud Apps (MDCA), Microsoft Purview, Microsoft Intune Endpoint Security, Support Incident & Ticket Management, ITSM Processes and Service Operations, Security.
 * Monitoring and troubleshooting, evidence collection and root cause analysis., * Experience supporting enterprise Microsoft security environments.
 * Exposure to Microsoft Defender XDR platforms and post-go-live hypercare support.
 * Experience working within regulated or highly governed enterprise environments.
 * Familiarity with ITSM tools, support queues, incident tracking systems, and structured escalation frameworks.
 * Experience collaborating with SOC, Compliance, Identity, Endpoint, and Infrastructure teams.

## Description

Job Description

We are seeking an experienced L1 Support SME - Microsoft Defender XDR Support to provide hypercare and operational support for Microsoft security platforms within a large enterprise environment.

The successful candidate will be responsible for issue intake, ticket triage, evidence collection, troubleshooting, escalation coordination, and stakeholder communication across Microsoft Defender for Endpoint (MDE), Microsoft Defender for Cloud Apps (MDCA), and Microsoft Purview.

Key Responsibilities

 * Provide Level 1 hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview.
 * Perform issue intake, ticket review, categorization, prioritization, and impact assessment.
 * Collect and analyze logs, screenshots, policy status, connector health information, validation outputs, and supporting evidence required for issue investigation.
 * Support initial troubleshooting for Defender, Intune policy deployments, MDCA connectors, and Purview policy-related issues.
 * Monitor and manage support tickets, ensuring timely updates, tracking, and closure of incidents.
 * Coordinate escalations to L2/L3 support teams, SMEs, or client stakeholders when advanced investigation is required.
 * Maintain accurate ticket documentation, issue summaries, remediation actions, and status reports.
 * Follow established runbooks, support procedures, governance standards, and operational guidelines.
 * Collaborate with Security Operations, Endpoint Management, Identity, Compliance, and Infrastructure teams to resolve issues effectively.
 * Participate in hypercare activities and ensure adherence to agreed service levels and support processes.

Required Qualifications

 * Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related discipline.
 * Experience in L1 Support, Microsoft Security Operations, Endpoint Support, Service Desk Operations, or Microsoft 365 Support environments.
 * Strong understanding of incident management, ticket lifecycle management, and escalation procedures.
 * Excellent communication, documentation, and stakeholder management skills.
 * Technical Skills: Microsoft Defender for Endpoint (MDE), Microsoft Defender for Cloud Apps (MDCA), Microsoft Purview, Microsoft Intune Endpoint Security, Support Incident & Ticket Management, ITSM Processes and Service Operations, Security.
 * Monitoring and troubleshooting, evidence collection and root cause analysis.

Preferred Certifications

 * SC-200: Microsoft Security Operations Analyst
 * MD-102: Endpoint Administrator
 * SC-900: Security, Compliance, and Identity Fundamentals
 * AZ-500: Azure Security Engineer Associate
 * SC-300: Identity and Access Administrator
 * SC-401: Information Security Administrator

Preferred Experience

 * Experience supporting enterprise Microsoft security environments.
 * Exposure to Microsoft Defender XDR platforms and post-go-live hypercare support.
 * Experience working within regulated or highly governed enterprise environments.
 * Familiarity with ITSM tools, support queues, incident tracking systems, and structured escalation frameworks.
 * Experience collaborating with SOC, Compliance, Identity, Endpoint, and Infrastructure teams.


## Related Videos

- [Developer Tools for Microsoft Azure](https://www.wearedevelopers.com/videos/450-developer-tools-for-microsoft-azure)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Green Cloud Computing](https://www.wearedevelopers.com/videos/592-green-cloud-computing)
- [Develop enterprise-ready applications for Microsoft Teams with Azure resources on modern web technologies](https://www.wearedevelopers.com/videos/187-develop-enterprise-ready-applications-for-microsoft-teams-with-azure-resources-on-modern-web-technologies)
- [Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.](https://www.wearedevelopers.com/videos/100339-hacking-mssql-on-cloud-all-of-them-how-i-became-sysadmin-on-azure-aws-gcp-and-alibaba)

## Related Articles

- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems)
- [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)