Microsoft Defender Security Engineer L3

VaporVM; Dubai; On-site; AED 300,000 - 540,000; Full time

Benefits offered by this job

Remote work opportunities

Job summary

VaporVM is seeking an experienced Microsoft Defender Security Engineer L3 to manage and optimize Microsoft Defender workloads across XDR, Defender for Endpoint, and related services in the Dubai area. The role emphasizes threat detection, incident investigation, and automation using KQL and PowerShell.

The ideal candidate will have hands-on administration across Defender platforms, live in the UAE, and collaborate with MSSP SOC to ensure proactive security and compliant operations.

Qualifications

• Bachelor's degree in Engineering or related discipline.
• 5–6 years of relevant cybersecurity experience with hands-on Defender workloads.
• Strong hands-on administration, configuration, monitoring, and investigation across Defender workloads.

Responsibilities

• Platform Administration: Onboard and maintain devices, servers, sensors, and integrations across Defender workloads.
• Security Configuration & Engineering: Implement and optimize security policies, endpoint protection, email security, and cloud controls.
• L3 Security Monitoring & Incident Response: Investigate escalated incidents, perform root cause analysis, and coordinate containment with MSSP SOC.
• Detection Engineering & KQL: Develop, maintain, and optimize KQL queries and detection rules.
• SIEM & SOAR Integration: Integrate Defender with SIEM/ SOAR platforms, manage log onboarding and playbooks.
• Automation & Security Copilot: Leverage Security Copilot for triage, investigation, and automated responses.
• Cross-functional Collaboration: Coordinate with multiple teams to address gaps and changes.
• Documentation & Reporting: Maintain playbooks, baselines, audit evidence, and monthly security reports.

Skills

Defender XDR

KQL

PowerShell

Threat hunting

Incident investigation

SIEM/SOAR integrations

Windows security

Entra ID/Active Directory

Education

Bachelor's degree in Engineering

Tools

IBM QRadar SIEM

Trend Micro Endpoint Security

SOAR platforms

Job description

We are seeking an experienced Microsoft Defender Security Engineer L3 to manage, administer, configure, and optimize Microsoft’s advanced security platforms. The ideal candidate will have strong hands-on expertise across Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Servers, and Defender for Cloud Apps. The role involves advanced security administration, threat detection, incident investigation, KQL-based threat hunting, security engineering, and integration with enterprise SIEM and SOAR platforms.

Key Responsibilities

• Platform Administration: Onboard and maintain devices, servers, sensors, and integrations across Microsoft Defender workloads. Manage security configurations, access controls, and platform health.
• Security Configuration & Engineering: Implement, configure, and optimize security policies, endpoint protection, attack surface reduction, email security, identity protection, and cloud application controls.
• L3 Security Monitoring & Incident Response: Investigate and resolve escalated security incidents, perform root cause analysis, conduct KQL-based threat hunting, and coordinate authorized containment and remediation activities with the MSSP SOC.
• Detection Engineering & KQL: Develop, maintain, and optimize KQL queries, detection use cases, hunting queries, and custom detection rules across Defender XDR, MDI, and MDO.
• SIEM & SOAR Integration: Integrate Microsoft Defender with IBM QRadar SIEM, Trend Micro endpoint security, and SOAR platforms. Manage log-source onboarding, alert and incident forwarding, automated playbooks, and ITSM workflows.
• Automation & Security Copilot: Leverage Microsoft Security Copilot to support security triage, investigation, threat enrichment, and automated response workflows.
• Cross-functional Collaboration: Coordinate with endpoint, server, identity, messaging, cloud, and application teams to address security gaps, troubleshoot agent and sensor issues, and implement approved changes.
• Documentation & Reporting: Maintain operational playbooks, configuration baselines, audit evidence, and technical documentation. Provide weekly task updates and monthly reports covering security coverage, platform health, incidents, tuning activities, and identified risks.

Required Qualifications & Skills

• Bachelor's degree in Engineering, preferably Computer, Information Technology, Electronics, or a related discipline.
• 5-6 years of relevant cybersecurity experience, with hands-on administration, configuration, monitoring, and investigation across Microsoft Defender security workloads.

Strong practical experience with:

• Microsoft Defender for Identity (MDI)
• Proven experience integrating and operating IBM QRadar SIEM, Trend Micro endpoint security, and SOAR platforms with Microsoft Defender.
• Hands-on expertise in log-source onboarding, alert and incident forwarding, automated playbooks, and ITSM workflows.
• Strong proficiency in Kusto Query Language (KQL) and PowerShell for threat hunting, detection engineering, investigation, and automation.
• Practical knowledge of Windows/Linux security, Microsoft Entra ID, Active Directory, Exchange Online, incident response, and enterprise SIEM/ITSM integrations.
• Ability to troubleshoot complex security issues, optimize detection capabilities, and collaborate with SOC and infrastructure teams.

Preferred Certification

• Microsoft Certified: Security Operations Analyst Associate (SC-200)