Specialist - NetSecOps - MDE Operations and Support

Role overview

Operations and incident support

• Provide day-to-day MDE and MDAV administration and technical support across endpoints and servers.
• Raise and drive Microsoft support cases, product investigations, and service escalations.
• Lead technical bridge calls for P1/P2 service, platform-health, or critical sensor incidents; engage relevant teams and track actions.
• Provide validation, troubleshooting, and rollback support during approved change windows.
• Support server, application-health, and security incidents involving endpoint protection.
• Monitor queues, service-health notifications, incidents, requests, and assigned work; maintain progress updates and technical evidence.
• Follow incident, request, change, problem, and escalation procedures; document actions, outcomes, risks, and outstanding work.
• Prepare handovers covering unresolved incidents, planned work, and changes requiring continued support.

Policy groups and membership

• Build and administer MDE policy groups for Defender Antivirus, Attack Surface Reduction, and approved exclusions.
• Create, amend, test, and maintain dynamic and static device-group membership rules against approved requirements.
• Move devices into or out of groups on authorized requests, lifecycle events, and troubleshooting needs.
• Validate membership, policy assignment, and control enforcement after changes.
• Correct inaccurate, duplicate, stale, or missing memberships with platform owners.
• Maintain group-purpose, membership-logic, ownership, approval, and dependency records for traceability and audit readiness.
• Provide incident cover for approved temporary assignment changes and restore prior settings afterward.
• Periodically review static memberships and dynamic-rule outcomes, escalating weakened security coverage.

System support and remediation

• Collect and analyze MDE Client Analyzer logs and approved diagnostics for agent, connectivity, onboarding, configuration, and service-health faults.
• Run approved troubleshooting commands and capture outputs for incident records or Microsoft support cases.
• Reboot devices when approved and necessary for troubleshooting, remediation, or service restoration.
• Repair, reset, or remediate MDE agents and related components according to approved procedures while minimizing business disruption.
• Perform approved onboarding, re-onboarding, and offboarding; validate sensor connectivity, policy receipt, and reporting.
• Disable Tamper Protection locally only for approved, time-bound troubleshooting and verify it is re-enabled afterward.
• Troubleshoot sensor, service, signature, connectivity, proxy, onboarding, and policy-application problems.
• Verify endpoint health after remediation, including sensor and antivirus status, policy assignment, communication, and portal visibility.
• Work with server, desktop, network, identity, application, and security teams on issues beyond the MDE boundary.
• Escalate unresolved, recurring, or high-impact issues with evidence, reproduction details, logs, and prior troubleshooting.

Operational controls

• Use privileged access only for authorized work and follow least-privilege, segregation-of-duties, and secure-administration rules.
• Ensure exclusions, temporary control changes, and troubleshooting actions are approved, documented, limited in scope, and reversed when no longer needed.