FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Tech Stack
Tools & technologiesAzureCloudCyber SecurityPython
About the role
Key responsibilities & impact- Monitor alerts and incidents across client tenants in Microsoft Sentinel and Microsoft Defender products
- Triage incidents, verify automated enrichment, and meet acknowledgment and containment SLAs
- Investigate suspicious sign-ins, risky users, and conditional access failures in Microsoft Entra ID
- Write and tune KQL queries for threat hunting, investigation, and detection rule development
- Trigger, approve, reverse, operate, and author Sentinel automation rules and Logic Apps playbooks
- Escalate confirmed incidents with complete timelines and supporting evidence
- Review, approve, reject, validate, and reverse automated containment actions
- Monitor playbook health and maintain per-client automation settings
- Ensure client notifications accurately reflect automated actions
- Identify opportunities for new automation and tuning
- Follow change control procedures using Sentinel Repositories/CI-CD
- Notify clients of incidents via phone, email, or ticketing system
- Write incident summaries and remediation recommendations for technical and non-technical audiences
- Contribute to monthly client security reports and service reviews
- Tune analytics rules, update runbooks and knowledge base articles, and track emerging threats
- Participate in rotating after-hours, evening, weekend, and holiday on-call coverage for 24/7 client protection
- Maintain reliable home internet and phone for remote shifts and on-call coverage
Requirements
What you’ll need- 3–4 years of experience in a SOC, MSSP, MDR, or IT security operations role
- Hands-on production experience with Microsoft Sentinel and Microsoft Defender XDR
- Working knowledge of KQL
- Solid understanding of Microsoft Entra ID, Microsoft 365, Windows endpoints, networking fundamentals, and common attack techniques (MITRE ATT&CK)
- Clear written and verbal communication skills, including composure and clarity during active client incidents
- Availability and willingness to work evenings, weekends, holidays, and on-call rotations
- Ability to work independently with minimal supervision
- Working knowledge of Sentinel automation rules, incident tasks, and playbook triggers (incident, alert, and entity triggers)
- Sound judgment regarding when automation should be trusted and when it should be overridden
- Microsoft SC-200 certification required
- At least one of SC-300, AZ-500, AZ-104, or SC-401, or commitment to earn one within 90 days of hire
- Experience managing multiple tenants simultaneously through Azure Lighthouse or Defender XDR multi-tenant management
- Experience building Sentinel automation with Logic Apps, along with PowerShell or Python scripting
- Familiarity with Microsoft Security Copilot, Defender for Cloud, and Microsoft Purview
- SC-401 or SC-100
- Vendor-neutral certifications such as CISSP
- Bachelor's degree in cybersecurity, IT, or a related field, or equivalent experience
Benefits
Comp & perks- Medical, Dental, and Vision Insurance on the first day of employment
- Flexible Spending Account and Dependent Care Account
- 401k with Profit Sharing
- 9+ holidays and discretionary time off structure
- Parental Leave – coverage for both primary and secondary caregivers
- Tuition Assistance Program and CPA support program with cash incentive upon completion
- Discretionary incentive compensation based on firm, group and individual performance
- Incentive compensation related to origination of new client sales
- Top rated wellness program
- Flexible working environment including remote and hybrid options
- Competitive compensation
- Industry-leading benefits
- Flexible work environment to enjoy work/life balance