Administrator, Microsoft 365 Cybersecurity

Administer, configure, monitor, and continuously improve security and data-protection controls across the Microsoft 365 environment. Act as the primary administrator for Microsoft Defender and Microsoft Purview, protecting corporate endpoints, identities, email, collaboration services, and sensitive information while coordinating with Cybersecurity, SOC, IAM, and Infrastructure teams.

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.

Master’s degree in Computer Science, Information Technology, or a related discipline with relevant professional certification preferred.

• SC-200 – Security Operations Analyst

• SC-300 – Identity and Access Administrator

• SC-400 – Information Protection Administrator

• SC-100 – Cybersecurity Architect

• Other relevant Microsoft 365 / Azure security certifications

• Minimum 3–5 years of experience in IT, Microsoft 365, or cybersecurity.

• Minimum 2–3 years of hands-on experience with Microsoft 365 security technologies.

Experience supporting enterprise Microsoft 365 environments and working with SOC, IAM, endpoint, cybersecurity, and infrastructure teams.

Strong practical experience with: Microsoft Defender XDR, Endpoint, Office 365, Identity, and Cloud Apps; Microsoft Purview – DLP, Sensitivity Labels and eDiscovery; Microsoft Entra ID

Microsoft Intune; PowerShell; Kusto Query Language (KQL)

Excellent proficiency in Business English, including the ability to interpret technical requirements, prepare system documentation, and communicate effectively with technical and functional stakeholders.

• Microsoft 365 Security Administration 
• Incident Investigation & Response    
• Endpoint & Data Security Troubleshooting     
• Technical Requirement Translation   
• Documentation & Reporting

Primarily office-based, involving extensive use of computers and security administration tools, with regular interaction with technical, functional, and business teams.

None

Cybersecurity, SOC, IAM, Infrastructure, Digital Workplace, and GRC teams.

Microsoft Support, security technology vendors, and consultants.

Implement and modify approved security policies and configurations, remediate device vulnerabilities, manage data-loss prevention controls, and isolate compromised endpoints in accordance with approved cybersecurity standards and delegated access rights.

1

Microsoft 365 Security & Endpoint Protection: Administer and strengthen Microsoft 365 security controls to protect identities, endpoints, email, applications, and cloud services.

• Administer Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps.

• Manage endpoint security controls including Defender Antivirus, ASR, BitLocker, removable-media restrictions, and network/web protection.

• Monitor Microsoft Secure Score and review security configurations across Entra ID, Exchange, SharePoint, OneDrive, Teams, and Intune.

• Support Conditional Access, MFA, Identity Protection, Privileged Identity Management (PIM), and Zero Trust principles.

• Identify configuration and endpoint vulnerabilities and coordinate timely remediation.

2

Data Protection, Compliance & Governance: Protect sensitive corporate information and maintain effective information-protection and compliance controls.

• Configure and manage Microsoft Purview, Sensitivity Labels, Information Protection, and Data Loss Prevention (DLP) policies.

• Administer Insider Risk Management, Communication Compliance, eDiscovery, and Audit requirements.

• Investigate data-loss incidents, unauthorized information sharing, and related policy violations.

• Coordinate with GRC, Legal, HR, and business stakeholders on information-protection and data-classification requirements.

• Provide technical evidence and support for internal and external security audits.

3

Security Monitoring & Incident Response: Detect, investigate, contain, and remediate Microsoft 365 security threats and incidents.

• Monitor Defender XDR alerts covering endpoint, identity, email, and cloud security events.

• Investigate malicious emails, compromised endpoints, identities, and other security events.

• Conduct proactive threat hunting and root-cause analysis using KQL and Advanced Hunting.

• Coordinate with the SOC and relevant technical teams on incident containment, remediation, and recovery.

• Maintain incident-response procedures and runbooks and recommend preventive actions based on incident findings.

4

• Support integration of Microsoft Defender with Microsoft Sentinel and other approved SIEM/SOC platforms.

• Use PowerShell to automate Microsoft 365 security-administration activities.

• Support Microsoft Graph-based security administration and integrations.

• Coordinate with cross-functional IT teams to implement security controls and enhancements.

• Identify opportunities to improve security configurations, workflows, monitoring, and administrative efficiency.

5

• Prepare reports covering Defender incidents, endpoint security posture, Secure Score, DLP incidents, vulnerabilities, and policy violations.

• Maintain technical documentation, configuration standards, operational procedures, and security runbooks.

• Document security changes, exceptions, incidents, and corrective actions.

• Maintain appropriate security records and supporting evidence for governance and audit requirements.

• Recommend continuous improvements based on security trends, incidents, vulnerabilities, and control performance.

6

• Comply with applicable HSE policies, procedures, and workplace requirements.

• Participate in mandatory HSE training and awareness activities.

• Report hazards, incidents, and unsafe conditions promptly.

• Maintain a safe and ergonomically appropriate workstation.

• Protect company systems, information, equipment, and other resources in accordance with established requirements.