Microsoft Sentinel & Intune Engineer (SIEM/MDM Specialist)

Role Summary:

We are seeking an experienced Microsoft Security Engineer with strong hands-on expertise in Microsoft Sentinel (SIEM/SOAR) and Microsoft Intune (Endpoint Compliance & Access Control). The candidate will be responsible for designing, implementing, customizing, and supporting our SIEM dashboards, threat detection rules, connectors, and device compliance policies to strengthen our cybersecurity posture.

This is a core technical role the candidate must have direct hands-on experience in end-to-end deployment of both Sentinel and Intune in enterprise environments.

Key Responsibilities:

Microsoft Sentinel (SIEM):

• Enable and configure data connectors: Azure Activity, AWS CloudTrail/GuardDuty, On-prem AD, Cisco ASA/Firepower, FortiGate firewalls.
• Deploy and manage Syslog collector VMs for firewall/AD log ingestion.
• Configure IoC/IoA threat intelligence feeds (MISP, OTX, Recorded Future, etc.).
• Build custom dashboards (Top Talkers, Incident Overview, Events per Device, Rule Hits, Device Coverage).
• Write and implement custom KQL correlation rules (beyond Microsoft built-ins).
• Tune rules to reduce false positives and align with SOC operational needs.
• Provide incident playbooks/runbooks for SOC team.
  

Microsoft Intune (MDM):

• Review existing Intune configuration and optimize policies.
• Define and implement device onboarding (corporate devices + BYOD).
• Configure compliance validation policies (encryption, AV, OS patch levels).
• Define and implement conditional access (CA) policies for O365, SaaS apps, and internal systems.
• Integrate Intune with Defender for Endpoint and Sentinel for unified risk visibility.
• Generate compliance dashboards and audit-ready reports.
  

Cross-Functions:

• Work with Architect/Lead to align design with security framework.
• Document all configurations, rules, dashboards, and policies.
• Conduct structured knowledge transfer sessions for SOC/IT teams.
• Support audit and regulatory readiness (ISO 27001, PDPL, GDPR, etc.).

Required Skills & Experience:

• 8-12 years of hands-on experience in enterprise security engineering.
• Minimum 3+ years direct, practical experience with Microsoft Sentinel (KQL, connectors, dashboards, rules).
• Minimum 3+ years direct, practical experience with Microsoft Intune (compliance, CA, device onboarding).
• Strong expertise in Azure AD, Conditional Access, Defender for Endpoint integration.
• Proven experience writing custom KQL correlation rules (beyond out-of-box templates).
• Familiarity with Syslog/CEF ingestion for firewalls and AD logs.
• Experience integrating multi-cloud (Azure + AWS) into Sentinel.
• Solid understanding of IoC/IoA feeds and Threat Intelligence integrations.
• Strong documentation and KT delivery experience.
• Certifications preferred:
  
• SC-200: Microsoft Security Operations Analyst
• SC-300: Microsoft Identity and Access Administrator
• SC-400: Microsoft Information Protection
• MS-101/MD-101: Microsoft 365 Enterprise Admin / Modern Desktop Administrator
  

Soft Skills:

• Strong communication and stakeholder-facing ability.
• Ability to lead discussions with security teams and senior management.
• Problem-solving mindset balancing business risk vs technical enforcement.
• Can work independently and deliver under tight timelines.