Interested in security and incident response? Then come join the Cybersecurity Incident Response Team (CIRT) at Microsoft as a security support engineer responsible for helping customers investigate security incidents in their environment.

• Minimum 2+ years Security Incident Response experience with recent operational security experience (SOC, Malware Analysis, IDS/IPS Analysis, threat analytics, windows server, and endpoint security, etc.)
• Minimum 1+ years of experience in Network Security Administration, and/or Systems Administration with experience in Windows Server, Windows Client, and Active Directory Administration
• Minimum 1+ years customer facing experience
• Experience supporting large and complex geographically distributed enterprise environments with 1000+ users
• Bachelor's degree in Computer Science, Information Technology (IT), or related field AND 5+ years of technical support, technical consulting experience, or information technology experience
• OR 7+ years of technical support, technical consulting experience, or information technology experience.
• OR equivalent experience

Additional or Preferred Qualifications (PQs)

• Cloud experience with any of the major cloud providers, including cloud security, networking, and migration of multi-cloud or hybrid deployments
• Automation (PowerShell and/or Python, Java, or a similar language, can be a beginner to intermediate level).
• Experience in Linux and/or Mac administration
• Experience in Azure Identity management and troubleshooting
• Preferred Bachelor’s degree or higher in a technical field, or relevant work experience
• Preferred IT Industry certifications (Microsoft Certifications On-Prem or Cloud, SANS GCIH, CISSP, CEH, Amazon AWS, etc.)

• Scope customer security incidents
• Understand and identify indicators of attack and indicators of compromise
• Analyse incident data from threat analytics tools
• Communicate recommendations and guidance based on results of security incident analysis to the customer
• Coordinate a response to the security incident with other Microsoft security and consulting teams.
• Develop, document, and implement runbooks, capabilities, and techniques for Incident Response
• Perform security triage and analysis on endpoint, server and network infrastructure.
• Collaborate with the security intelligence team by providing samples of malware from the customer’s environment
• Perform activities necessary for immediate containment and short-term resolution of incidents.
• Maintain current knowledge and understanding of the threat landscape, emerging security threats, and vulnerabilities
• Investigate root cause of complex security incidents
• Maintain a high level of confidentiality
• Participate in the on-call rotation as required