Microsoft Defender & Sentinel Administrator

Microsoft Defender Administration

• Threat Protection: Administer and optimize Microsoft Defender XDR components, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps.
• Vulnerability Management: Monitor endpoint health, assess software vulnerabilities, and enforce security baselines across multi-platform endpoints (Windows, macOS, Linux, mobile).
• Incident Triage: Investigate high-priority security alerts, analyze threat vectors, and execute containment or remediation steps.

Microsoft Sentinel Operations

• Workspace Management: Administer Microsoft Sentinel workspaces, configure data connectors, and ensure the seamless ingestion of logs from Azure, M365, and third-party sources.
• Detection Engineering: Create, test, and tune analytics rules, hunting queries, and parsers using Kusto Query Language (KQL) mapped to the MITRE ATT&CK framework.
• Threat Proactivity: Conduct proactive threat hunting to uncover hidden anomalous activity across identity, cloud, and network telemetry.

Automation & Orchestration

• Playbook Development: Design, build, and troubleshoot automation rules and security playbooks using Azure Logic Apps.
• Workflow Efficiency: Automate incident enrichment, triage notifications, ticket creation, and standard containment responses to reduce Mean Time to Respond (MTTR).

• Experience: 5+ years of hands-on experience in cybersecurity administration, security operations (SOC), or cloud infrastructure security.

• Technical Expertise:

• Deep knowledge of Microsoft Defender security suite and Microsoft Sentinel.
• Proficiency in Kusto Query Language (KQL) for log analysis and threat hunting.
• Experience building Azure Logic Apps and security playbooks.
• Familiarity with Microsoft Entra ID (Azure AD) and Microsoft Intune
• Must be familiar with Authorization protocol, MFA and conduction access.