- Endpoint Threat Management:Configure and deploy Microsoft Defender for Endpoint in complex environments, including endpoint hardening and attack surface reduction.
- Automated Threat Detection & Incident Response:Setup automated workflows for threat mitigation while minimizing false positives.
- Threat Hunting and Vulnerability Management:Utilize Threat & Vulnerability Management to proactively identify and address security gaps.
- Integration & Customization:Develop custom detection rules and response playbooks; integrate with third-party tools.
- Comprehensive SIEM Implementation:Deploy and configure Microsoft Sentinel as a SIEM, integrating data from various sources.
- Advanced Analytics & KQL:Create analytics rules and workbooks using Kusto Query Language.
- Automation & Playbook Design:Implement automated playbooks leveraging Sentinel's orchestration capabilities.
- Data Governance & Compliance:Configure Microsoft Purview to ensure compliance with regulations like GDPR and CCPA.
- Data Loss Prevention (DLP):Implement DLP strategies across varied platforms.
- Data Insights & Reporting:Provide insights on data landscapes using Microsoft Purview’s tools.
- Workshops & Training:Lead workshops and knowledge sessions to maximize the utilization of Microsoft security solutions.
- Post-Implementation Reviews:Conduct assessments to evaluate and improve solution performance.
- Stakeholder Engagement:Collaborate with executive stakeholders for strategic guidance on security practices.
- Advanced knowledge in Microsoft Defender for Endpoint, Sentinel SIEM functionality, and Microsoft Purview.
- Proficiency in KQL for creating customized queries and dashboards.
- Skilled in SIEM and SOAR functionalities, focusing on automation and incident orchestration.
- Microsoft Certified: Security Operations Analyst Associate (SC-200) [Required].
- Microsoft Certified: Azure Security Engineer Associate (AZ-500) [Preferred].
- Microsoft Certified: Microsoft Purview Data Loss Prevention Specialist [Highly Desirable].
- 5+ Years in Cybersecurity focusing on endpoint protection, SIEM solutions, and data governance.
- Extensive experience in incident response, threat hunting, and effective security control implementation.
- Proven record of delivering successful security projects within tight deadlines and managing client expectations effectively.