Security Operations Engineer

About the role

Microsoft's Cloud Operations & Innovation (CO+I) is looking for a Security Operations Engineer to help deliver the core infrastructure and foundational technologies for its online services, including Bing, Office 365, Xbox, OneDrive and the Microsoft Azure platform. You will implement and operate cloud and on-premises cybersecurity controls to protect datacenter-critical infrastructure from threat actors, working with internal and external teams. The role is open for a minimum of 5 days, with partial or full remote work possible.

Key responsibilities

• Incident response: lead and take part in security incident investigations across cloud, on-premises and hybrid environments, coordinate them with engineering, platform, identity, network and application teams, and maintain incident response playbooks, procedures and runbooks.
• Threat detection and security operations: monitor, investigate and respond to alerts using Microsoft Sentinel, Microsoft Defender XDR and other SIEM, EDR and NDR tools; hunt threats proactively and tune detection rules and analytics with threat intelligence.
• On-call rotation supporting security services and incident response.
• Security automation: design and implement SOAR workflows and automation using PowerShell, Python, KQL, Logic Apps or Azure Functions, and integrate security technologies and telemetry into security operations platforms.

Required profile

• 3+ years of experience in cybersecurity, SOC operations, incident response, blue team, large-scale computing, software development or a related field; or a bachelor's degree in a related field or equivalent experience.
• Experience investigating security incidents such as malware, credential compromise, unauthorized access or insider threats.
• Knowledge of the incident response lifecycle, security monitoring, threat detection and SIEM, EDR or SOAR technologies.
• Background check: ability to meet Microsoft, customer and/or government security screening requirements, including the Microsoft Cloud background check.

Required skills

• Experience with Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, Elastic or comparable platforms.
• Hands-on scripting or security query language such as KQL, PowerShell or Python.
• Understanding of network security and experience securing large-scale cloud environments, preferably Microsoft Azure.
• Preferred: CISSP, CISA, CISM, SANS, GCIA, GCIH, OSCP, PCCSE, PCNSE, PCSAE, CCNP Security, CCIE Security or Security+; experience with OT, manufacturing, critical infrastructure or energy environments.

What we offer

• Flexible work, partially or fully from home.
• On-the-job learning and bi-directional mentorship.
• Training, career rotation programs, diversity and inclusion events and professional certifications.