Job Title: Microsoft Defender & Sentinel Administrator
Location: 100% Remote (Central Time Zone preferred)
Experience: 5+ Years
Duration: Long-term
Employment Type: Contract / Full-Time
Position Summary
We are seeking an experienced Microsoft Defender & Sentinel Administrator to manage, configure, and optimize security operations platforms. The ideal candidate will have hands-on experience with Microsoft Sentinel, Kusto Query Language (KQL), Microsoft Defender XDR, incident response, identity security, and security automation.
The primary focus of this role is to enhance SIEM and XDR capabilities, develop detection rules, perform proactive threat hunting, and automate security response workflows to strengthen enterprise security.
This is a fully remote opportunity, with a preference for candidates located in the Central Time Zone.
Must-Have Skills
Microsoft Sentinel + KQL (Kusto Query Language) — Highest Priority
Microsoft Defender XDR
Azure Logic Apps & Security Playbooks
Identity & Access Management — Microsoft Entra ID, MFA, Conditional Access
Incident Response & Security Incident Investigation
Key Responsibilities
Microsoft Sentinel Administration
Administer Microsoft Sentinel workspaces and configure data connectors for log ingestion from Azure, Microsoft 365, and third-party sources.
Develop, test, and tune analytics rules, detection logic, hunting queries, and parsers using KQL.
Perform proactive threat hunting across identity, endpoint, cloud, and network telemetry.
Map detection logic and security use cases to the MITRE ATT&CK framework.
Investigate security incidents and improve monitoring and detection capabilities.
Microsoft Defender XDR Administration
Administer and optimize Microsoft Defender XDR, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps.
Monitor endpoint security, assess vulnerabilities, and enforce security baselines across Windows, macOS, Linux, and mobile devices.
Investigate security alerts, analyze threats, and implement containment and remediation measures.
Security Automation and Orchestration
Develop, configure, and troubleshoot security playbooks using Azure Logic Apps.
Configure Sentinel automation rules and automate incident enrichment, triage notifications, ticket creation, and response workflows.
Improve operational efficiency and reduce Mean Time to Respond (MTTR).
Document playbooks, automation workflows, and incident response procedures.
Identity and Access Security
Support Microsoft Entra ID and Microsoft Intune security configurations.
Implement and maintain Multi-Factor Authentication (MFA) and Conditional Access policies.
Apply knowledge of OAuth 2.0, OpenID Connect, and SAML authentication protocols.
Support identity threat detection, access monitoring, and security policy enforcement.
Incident Response
Investigate and triage security incidents involving endpoints, identities, cloud applications, and suspicious activities.
Analyze alerts and logs to identify root causes, threat vectors, and potential impact.
Execute appropriate containment, remediation, and recovery procedures.
Document findings and recommend improvements to detection and response processes.
Required Qualifications
5+ years of hands-on experience in cybersecurity administration, SOC operations, incident response, or cloud security.
Strong practical experience with Microsoft Sentinel and KQL for security monitoring, threat hunting, and detection engineering.
Hands-on experience administering Microsoft Defender XDR.
Experience developing Azure Logic Apps and automated security playbooks.
Working knowledge of Microsoft Entra ID, identity protection, MFA, and Conditional Access.
Strong understanding of incident response and security investigation processes.
Excellent troubleshooting, analytical, documentation, and communication skills.
Preferred Qualifications
Microsoft security certifications such as SC-200, AZ-500, or SC-100.
Experience supporting enterprise security operations or public sector environments.
Knowledge of security frameworks, threat intelligence, and the MITRE ATT&CK framework.
Experience integrating third-party security products and log sources with Microsoft Sentinel.
Candidate Submission
Interested candidates should submit an updated resume highlighting hands-on experience with Microsoft Sentinel, KQL, Defender XDR, Logic Apps playbooks, identity security, and incident response.