Microsoft Defender Administrator

This is a fully remote position, open to applicants in United States.

📋 Description

• Monitoring Endpoint Detection and Response (EDR): Continuously observe EDR solutions to identify and report threats to the Security Operations Center (SOC) in real-time.

• Managing Next-Generation Antivirus (NGAV): Ensure that NGAV solutions operate optimally while addressing any alerts or issues. Conduct routine checks and updates to sustain peak performance.

• Maintaining Attack Surface Reduction: Implement rules and controls to reduce the attack surface of endpoints, as specified by the SOC. Report any deviations or concerns to the engineering team for assessment.

• Integrating Cloud-Delivered Protection: Confirm that real-time updates and threat intelligence from the Microsoft cloud are received and applied. Notify the engineering team of any discrepancies or issues.

• Connecting with SIEM Solutions: Facilitate the seamless integration of Microsoft Defender with Microsoft Sentinel and other SIEM tools. Oversee centralized logging, analytics, and reporting dashboards. Conduct data analysis using the SIEM tool as needed.

• Ensuring Cross-Platform Protection: Validate comprehensive security measures across Windows, Linux, and mobile devices. Report any platform-specific issues to the engineering team.

• Delivering Comprehensive Reporting and Analytics: Create and review detailed reports concerning security posture, incidents, and compliance. Ensure that dashboards and alerts function correctly and report any issues encountered.

• Applying Prescribed Procedures: Adhere to established procedures and guidelines for maintaining Microsoft Defender solutions. Escalate any issues or anomalies to the engineering team.

• Implementing Windows Defender Application Control (WDAC): Ensure that WDAC policies are applied correctly and function as intended. Report any policy violations or issues to the engineering team.

• Integrating Microsoft Defender, Intune, and Purview for Data Loss Prevention (DLP): Ensure the correct implementation and functionality of DLP policies across endpoints, mobile devices, and cloud services. Apply approved DLP waivers for authorized users and devices. Monitor DLP incidents and report any policy violations or data exfiltration attempts to the engineering team. Maintain unified reporting and alerts for any DLP-related issues.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Information Security, or a related field.

• 3+ years of relevant experience.

• Experience with Microsoft Defender for Endpoint, Cloud, and Servers.

• Familiarity with endpoint security, threat hunting, and incident response.

• Knowledge of SIEM solutions, particularly Microsoft Sentinel.

• Excellent attention to detail and problem-solving abilities.

• Strong communication and collaboration skills to engage effectively with stakeholders at all levels.

• Understanding of industry compliance standards (e.g., NIST) and relevant regulations (e.g., GDPR, HIPAA) is a plus.

• Willingness to remain informed about the latest cybersecurity trends and emerging security tools.

• Required DoD 8140 compliant certification such as CompTIA Security+.

🏝️ Benefits

• Health insurance

• 401(k) matching

• Flexible work hours

• Paid time off

• Remote work options