Microsoft Security Consultant

Role purpose

What you will deliver

• Build unified SecOps environments with Microsoft Sentinel and Defender XDR.
• Deploy and optimize Defender for Endpoint, Identity, Office 365, Cloud Apps, and multi-cloud workloads.
• Implement identity security with Conditional Access, Entra ID Protection, PIM, and Zero Trust baselines.
• Implement device management and security with Intune and Defender for Endpoint.
• Roll out Purview classification, sensitivity labels, data protection, DLP, automatic classification, and Insider Risk Management.
• Enable Copilot for Security scenarios for investigations, threat hunting, and automated response.
• Provide documentation, governance models, SOC runbooks, and customer enablement.

Customer delivery

• Lead discovery, architecture, remediation, and implementation workshops with customer CISOs and security teams.
• Operationalize Defender XDR and improve detection and response.
• Improve identity security through Conditional Access redesigns and hardened authentication flows.
• Improve data security with Purview policies, Insider Risk workflows, and sensitivity classification.
• Guide SOC teams in Copilot for Security investigations, triage, reporting, and hunting.
• Produce executive insights connecting security outcomes to business impact.
• Build Sentinel analytics rules, automation, UEBA, and hunting queries (bonus).

Experience and capabilities

• Strong delivery experience with Defender XDR, Entra ID, Purview, Defender for Cloud, and Sentinel.
• Experience with Zero Trust architectures and modern identity lifecycle practices.
• Ability to work across SecOps, cloud security, identity, and data protection.
• Experience with KQL for threat hunting, detection engineering, and investigations.
• Strong workshop, communication, and customer-facing consulting skills.
• Enterprise customer experience across MEA is a plus.

Bonus experience

• Copilot for Security, agent-based security models, GitHub Advanced Security, and multi-cloud security experience are bonuses.
• Building Sentinel analytics rules, automation, UEBA, and hunting queries is a bonus.

Helpful certifications

• SC-200, SC-300, SC-400 or SC-401, SC-100, and AZ-500 certifications are beneficial but not required.

Six-month success outcomes