Microsoft Defender Xdr

Microsoft Defender Xdr Engineer Jobs

3 jobs found

Today

Senior Cybersecurity Engineer

Teleion Consulting Seattle, WA

Seattle, WA

Today

$155k - $200k/yr Contract Senior Azure Ad / Entra Id Cloud Platforms

Apply Now

Job Description

Teleion Consulting is hiring a hands-on, client-facing Senior Cybersecurity Engineer to help strengthen cloud security posture and operational readiness for real-world threats. This onsite contract role in Seattle, WA focuses on maturing incident response, advancing data protection, and improving zero trust capabilities across the Microsoft security ecosystem, including Sentinel, Defender, Entra, Intune, and Microsoft Purview.

You will directly support production client environments by configuring and operating Microsoft security tools, leading incident response activities end-to-end, and building durable detection and automation workflows that reduce noise and improve analyst efficiency. The role also includes improving security hygiene in Azure and multi-cloud settings through benchmark remediation and identity and entitlement risk reduction.

Responsibilities

Configure, tune, and operate the Microsoft security stack in production client environments, including Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Lead incident response for real security events such as account compromise, data exfiltration, insider risk, and BEC, covering containment, eradication, recovery, evidence preservation, and post-incident reporting.
Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards.
Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost.
Develop SOAR playbooks to reduce false positive volume and automate analyst workflows.
Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps, moving findings to closure rather than alerting only.
Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
Harden Azure and multi-cloud environments by remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns.
Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.
Design and run tabletop exercises to test and mature the client’s incident response capability.

Requirements

7+ years of security engineering or security operations experience in enterprise environments.
Production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Demonstrated leadership of real security incidents through the full lifecycle, including containment, eradication, recovery, and post-incident reporting.
Strong KQL proficiency, including analytic rules, hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK.
Direct, demonstrable Microsoft Purview experience across DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery.
Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Experience implementing zero trust controls across multiple pillars using Conditional Access and PIM (privileged access management).
PowerShell and Microsoft Graph API proficiency for security automation.
Experience coordinating with MXDR or managed SOC providers on escalation and case quality.
Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Cloud and M365 digital forensics experience is a plus.

Benefits

Full benefits
PTO
Holiday
401(k)

Salary: USD 155,000 - 200,000 per year. Location: Seattle, WA (onsite). Job type: contract.

View full job page →

Today

Cybersecurity Engineer

LevelBlue LLC United States

United States

Today

$85k - $120k/yr Full time Azure Conditional Access Azure Security Azure Security Posture Management

Apply Now

Job Description

Lead client-ready Microsoft security delivery as a Senior Cybersecurity Engineering Consultant focused on Microsoft Purview, Defender XDR, Entra ID hardening, and Azure security posture assessments for onsite work across the United States.

Responsibilities

Lead Purview engagements including current-state assessment, target design, phased rollout, and configuration of scoped capabilities such as information protection, DLP, audit, and related controls.
Implement and harden Microsoft Defender XDR and Entra ID security, covering Conditional Access and identity-protection patterns aligned to the client’s operating model (not a demo tenant).
Deliver Azure security posture assessments and guided hardening across landing-zone and control-plane hygiene, Defender for Cloud, and a prioritized hardening roadmap.
Where scoped, perform assessment-level Active Directory and hybrid identity work including privilege, delegation, legacy protocol exposure, and a prioritized hardening roadmap.
Create client-ready artifacts including gap analyses, configuration baselines, implementation plans, and operational handover that can be executed.
Run workshops with security, compliance, identity, and IT stakeholders to capture requirements, decisions, risks, and scope changes.
Support pre-sales with effort estimates, technical scope definition, and solution shaping.

Requirements

Senior consulting or professional-services delivery experience, including running workshops and delivering scope and artifacts the client accepted.
Hands-on Microsoft Purview implementation in a production or client tenant, including designing and configuring controls.
Hands-on Microsoft Defender XDR experience, with Defender for Endpoint plus at least one of Identity, Office, or Cloud Apps.
Hands-on Entra ID security experience, including Conditional Access, identity protection / risk patterns, and privileged-access basics as implemented in the tenant.
Ability to assess requirements and recommend a target configuration with practical implementation guidance, including what to phase and what not to enable.

Technologies

Microsoft Purview
Microsoft Defender XDR (including Defender for Endpoint)
Entra ID
Conditional Access
identity protection / risk patterns
Microsoft Defender for Cloud
Azure security posture assessments
Active Directory
Microsoft Sentinel
AWS

Strongly Preferred

Active Directory security assessments in hybrid estates: privilege, stale admin paths, legacy auth, and a hardening roadmap.
Azure security assessments and control implementation, including Defender for Cloud.
Landing Purview, Defender, and Entra telemetry in Microsoft Sentinel (connectors, data usefulness, detections).

Useful

AWS or multi-cloud posture reviews.
Network-edge reviews on occasional engagements, including firewall/VPN policy, logging, and segmentation.

Certifications (Desirable)

Most relevant: SC-400; SC-300; SC-200
Also useful: SC-500 (AZ-500); SC-100; CISSP or CISM

Location: United States (onsite)

Salary: USD 85,000 - 120,000 per yearly

View full job page →

19d ago

Security Engineer

MANATT, PHELPS & PHILLIPS LLP New York, NY

New York, NY

19d ago

$80k - $100k/yr Full time Cybersecurity Tools Edr Mdr Endpoint Security

Apply Now

Job Description

MANATT, PHELPS & PHILLIPS LLP is seeking a Security Engineer to strengthen the firm’s Information Technology security operations. The role focuses on maintaining security controls, supporting incident response activities, and helping the organization adopt secure technology practices.

Key Responsibilities

Establish, monitor, and enforce security policies, procedures, and controls across the firm’s Information Technology environment.
Implement, administer, and maintain security infrastructure and tools, including endpoint protection, detection and response platforms, vulnerability management solutions, and related security controls.
Investigate security alerts to identify root cause and coordinate timely remediation with the appropriate stakeholders.
Monitor security risk trends and recommend updates to policies, practices, and tools to respond to evolving threats.
Coordinate protective measures such as targeted system scans and follow-up remediation as needed.
Partner with IT and business teams to provide practical security guidance and support secure technology usage.
Support security awareness initiatives, including employee orientation, training, and ongoing guidance.
Maintain critical access information and related security records in accordance with firm procedures.
Perform other duties as assigned.

Required Qualifications

5+ years of Information Technology security experience in a Microsoft Windows and enterprise environment.
Hands-on experience with CrowdStrike Falcon, including endpoint monitoring, threat detection, incident investigation, and response.
Experience implementing, administering, or monitoring Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) solutions.
Working knowledge of security monitoring, threat hunting, vulnerability management, and incident response best practices.
Minimum of 2 years of network security experience.
Strong written and verbal communication skills, with the ability to explain security concepts to technical and non-technical audiences.
Strong organizational skills, attention to detail, and ability to manage competing priorities.
Ability to work independently with limited supervision while contributing effectively in a collaborative team environment.
Reliability and flexibility to work in a hybrid remote and in-office environment as business needs require.
Proficiency with Microsoft Office.
Hands-on experience with Microsoft Security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Sentinel, Microsoft Entra ID, and Microsoft Purview (preferred).
Bachelor’s degree in Information Systems, Cybersecurity, or a related field (preferred).
CISSP, GIAC, Microsoft Security, or other relevant cybersecurity certifications (a plus).

Technology Stack

Microsoft Windows
CrowdStrike Falcon
Endpoint Detection and Response (EDR)
Managed Detection and Response (MDR)
Microsoft Defender XDR
Microsoft Defender for Endpoint
Microsoft Sentinel
Microsoft Entra ID
Microsoft Purview
Microsoft Office

Location and Compensation

Location: New York, NY (hybrid)
Salary: USD 80,000 - 100,000 per year
Minimum Experience: 5 years

Benefits

A full range of medical, financial and/or other benefits dependent on the position

View full job page →

Microsoft Defender Xdr Engineer Jobs

Senior Cybersecurity Engineer

Cybersecurity Engineer

Security Engineer

Get Microsoft Defender Xdr Engineer Jobs alerts