Microsoft security Administrator

MPower Plus; Utrecht; On-site; EUR 70,000 - 110,000; Full time

Job summary

MPower Plus is seeking an IT security engineer specializing in Microsoft Defender for Endpoint to design, deploy, and optimize Defender for Endpoint across servers and endpoints. You will implement protection features, configure licensing (Defender for Servers), and manage integrations with Defender for Cloud, Intune and Azure Arc.

You will also tune alerts, reduce false positives, and drive automated investigations and remediation to reduce alert noise while maintaining strong security posture.

Qualifications

• Experience configuring and operating Microsoft Defender for Endpoint (MDE) at scale.
• Familiarity with Defender for Cloud, Microsoft Intune, and Azure Arc integration.
• Ability to reduce false positives and tune alerts using suppression tools and behavioral blocking.

Responsibilities

• Diagnose and resolve complex MDE issues across Server Plan 2 and Endpoint.
• Troubleshoot integrations with Defender for Cloud, Intune, and Azure Arc.
• Investigate false positives/negatives and optimize suppression and blocking.
• Lead onboarding of Windows, Linux, macOS, iOS and Android endpoints to MDE with proper licensing.
• Configure vulnerability management and OS configuration assessments per benchmarks.
• Collaborate with L1/L2 support and document resolutions in knowledge bases.

Job description

Diagnosing and resolving complex technical issues related to MDE Server Plan 2 and Endpoint, including next-generation antivirus, ASR Rules, EDR, attack surface reduction, and threat intelligence.Troubleshoot integration issues with Microsoft Defender for Cloud, Microsoft Intune, and Azure Arc).

Investigate and mitigate false positives/negatives, leveraging suppression tools and behavioral blocking capabilities.

2. Endpoint and Server Security Management:Configure and optimize MDE features, such as attack surface reduction rules, web protection, and device control for Windows, Linux, macOS, iOS, Android devices.Implement and manage agentless scanning, vulnerability assessments, and file integrity monitoring for servers under Defender for Servers Plan 3.Enable and fine-tune automated investigation and remediation processes to reduce alert volume and respond to threats in near real-time.

4. Deployment and Configuration:Lead onboarding of servers (Windows Server, Linux) and endpoints to MDE, ensuring compliance with licensing requirements (e.g., Defender for Servers Plan 2 for server environments). Configure MDE in mixed-licensing scenarios (Plan 1 and Plan 2) and apply device tagging for appropriate feature allocation. Set up network connectivity for MDE services, including proxy configurations and streamlined connectivity for cloud services.

5. Vulnerability Management and Compliance:Utilize Defender Vulnerability Management (core and premium add-on) to assess, prioritize, and remediate vulnerabilities across endpoints and servers.Conduct OS configuration assessments against Microsoft Cloud SecurityBenchmark and ensure compliance with regulatory standards. Provide recommendations to improve security posture using Microsoft Secure Score and agentless scanning capabilities.

6. Collaboration and Documentation:

1. Work with L1/L2 support teams to escalate and resolve issues, providing guidance and training on MDE features and best practices.

2. Document troubleshooting processes, configurations, and incident resolutions in knowledge bases for future reference.

3. Engage with Microsoft support and the Microsoft Security Community for advanced issue resolution and feature updates.