Cyber Security Engineer - MS Stack

Luvo; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

Luvo is seeking a Microsoft Security Engineer to operate, administer and improve Defender for Endpoint and Security Copilot within a large enterprise security program in Australia. The role is roughly 80% BAU operations and 20% delivery and continuous improvement.

You will manage runbooks, dashboards and audit evidence while advancing new use cases, automation and policy rollouts. Onsite/hybrid work in Sydney or Melbourne with critical infrastructure responsibilities.

Qualifications

• 5+ years in cyber security operations or security engineering.

Responsibilities

• Operate and improve Microsoft Defender for Endpoint and Security Copilot in a large enterprise
• Administer RBAC, configurations, prompts and integrations across Defender XDR, Sentinel, Entra and Purview
• Monitor SCU capacity, service health and platform performance
• Investigate endpoint alerts, threat hunt with KQL and coordinate remediation
• Manage vulnerability exposures, IOCs, tuning and exclusions through change control
• Handle ITIL incidents, requests, problems and changes to SLA including MS support
• Maintain runbooks, dashboards and audit evidence
• Support new use cases, automation, policy rollouts and handover to BAU

Skills

Cyber security operations

Defender for Endpoint / Defender XDR

Security Copilot

KQL

Threat hunting

Tools

Microsoft Defender for Endpoint

Security Copilot

Defender XDR

Job description

We are looking for a Microsoft Security Engineer to operate, administer and improve Microsoft Security Copilot and Defender for Endpoint in a large enterprise security environment. The split is about 80% BAU operations and 20% delivery and continuous improvement.

Key responsibilities

• Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
• Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
• Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
• Manage vulnerability exposure, IOCs, tuning and exclusions through change control
• Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
• Maintain runbooks, documentation, dashboards and audit evidence
• Support new use cases, automation, policy rollouts and the handover of projects into BAU

Key responsibilities

• Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
• Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
• Run day-to-day Defender for Endpoint operations: onboarding, sensor health, coverage, policies (ASR, AV, EDR, web/network protection, device control, tamper protection)
• Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
• Manage vulnerability exposure, IOCs, tuning and exclusions through change control
• Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
• Maintain runbooks, documentation, dashboards and audit evidence
• Support new use cases, automation, policy rollouts and the handover of projects into BAU

Must have

• 5+ years in cyber security operations, endpoint security or Microsoft security engineering
• 3+ years hands-on with Defender for Endpoint / Defender XDR
• Hands-on Security Copilot experience, or an equivalent AI-enabled SecOps platform
• Strong KQL, threat hunting and incident investigation skills
• Experience in regulated, critical-service environments with formal change management

Certifications

• Required: SC-500 (Cloud and AI Security Engineer) or an equivalent current Microsoft security certification, plus Security Copilot training (e.g. SC-5006)
• Highly regarded: SC-200, SC-300, MD-102, SC-100, ITIL Foundation, responsible AI training

Additional information

• Full-time | Onsite/Hybrid | Critical Infrastructure
• Sydney OR Melbourne location