Cyber Security Engineer - MS Stack in Sydney

We are looking for a Microsoft Security Engineer to operate, administer and improve Microsoft Security Copilot and Defender for Endpoint in a large enterprise security environment. The split is about 80% BAU operations and 20% delivery and continuous improvement.

Key responsibilities

• Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
• Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
• Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
• Manage vulnerability exposure, IOCs, tuning and exclusions through change control
• Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
• Maintain runbooks, documentation, dashboards and audit evidence
• Support new use cases, automation, policy rollouts and the handover of projects into BAU

Key responsibilities

• Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
• Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
• Run day-to-day Defender for Endpoint operations: onboarding, sensor health, coverage, policies (ASR, AV, EDR, web/network protection, device control, tamper protection)
• Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
• Manage vulnerability exposure, IOCs, tuning and exclusions through change control
• Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
• Maintain runbooks, documentation, dashboards and audit evidence
• Support new use cases, automation, policy rollouts and the handover of projects into BAU

Must have

• 5+ years in cyber security operations, endpoint security or Microsoft security engineering
• 3+ years hands-on with Defender for Endpoint / Defender XDR
• Hands-on Security Copilot experience, or an equivalent AI-enabled SecOps platform
• Strong KQL, threat hunting and incident investigation skills
• Experience in regulated, critical-service environments with formal change management

Certifications

• Required: SC-500 (Cloud and AI Security Engineer) or an equivalent current Microsoft security certification, plus Security Copilot training (e.g. SC-5006)
• Highly regarded: SC-200, SC-300, MD-102, SC-100, ITIL Foundation, responsible AI training

Additional information

• Full-time | Onsite/Hybrid | Critical Infrastructure
• Sydney OR Melbourne location

#J-18808-Ljbffr