Job Title: Microsoft Defender & Sentinel Administrator Location: 100% Remote (Central Time Zone preferred) Experience: 5+ Years Duration: Long-term Employment Type: Contract / Full-Time Position Summary We are seeking an experienced Microsoft Defender & Sentinel Administrator to manage, configure, and optimize security operations platforms. The ideal candidate will have hands-on experience with Microsoft Sentinel, Kusto Query Language (KQL), Microsoft Defender XDR, incident response, identity security, and security automation. The primary focus of this role is to enhance SIEM and XDR capabilities, develop detection rules, perform proactive threat hunting, and automate security response workflows to strengthen enterprise security. This is a fully remote opportunity, with a preference for candidates located in the Central Time Zone. Must-Have Skills Microsoft Sentinel + KQL (Kusto Query Language) — Highest Priority Microsoft Defender XDR Azure Logic Apps & Security Playbooks Identity & Access Management — Microsoft Entra ID, MFA, Conditional Access Incident Response & Security Incident Investigation

Key Responsibilities

Microsoft Sentinel Administration Administer Microsoft Sentinel workspaces and configure data connectors for log ingestion from Azure, Microsoft 365, and third-party sources. Develop, test, and tune analytics rules, detection logic, hunting queries, and parsers using KQL. Perform proactive threat hunting across identity, endpoint, cloud, and network telemetry. Map detection logic and security use cases to the MITRE ATT&CK framework. Investigate security incidents and improve monitoring and detection capabilities. Microsoft Defender XDR Administration Administer and optimize Microsoft Defender XDR, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps. Monitor endpoint security, assess vulnerabilities, and enforce security baselines across Windows, macOS, Linux, and mobile devices. Investigate security alerts, analyze threats, and implement containment and remediation measures. Security Automation and Orchestration Develop, configure, and troubleshoot security playbooks using Azure Logic Apps. Configure Sentinel automation rules and automate incident enrichment, triage notifications, ticket creation, and response workflows. Improve operational efficiency and reduce Mean Time to Respond (MTTR). Document playbooks, automation workflows, and incident response procedures. Identity and Access Security Support Microsoft Entra ID and Microsoft Intune security configurations. Implement and maintain Multi-Factor Authentication (MFA) and Conditional Access policies. Apply knowledge of OAuth 2.0, OpenID Connect, and SAML authentication protocols. Support identity threat detection, access monitoring, and security policy enforcement. Incident Response Investigate and triage security incidents involving endpoints, identities, cloud applications, and suspicious activities. Analyze alerts and logs to identify root causes, threat vectors, and potential impact. Execute appropriate containment, remediation, and recovery procedures. Document findings and recommend improvements to detection and response processes. Required Qualifications 5+ years of hands-on experience in cybersecurity administration, SOC operations, incident response, or cloud security. Strong practical experience with Microsoft Sentinel and KQL for security monitoring, threat hunting, and detection engineering. Hands-on experience administering Microsoft Defender XDR. Experience developing Azure Logic Apps and automated security playbooks. Working knowledge of Microsoft Entra ID, identity protection, MFA, and Conditional Access. Strong understanding of incident response and security investigation processes. Excellent troubleshooting, analytical, documentation, and communication skills.

Preferred Qualifications

Microsoft security certifications such as SC-200, AZ-500, or SC-100. Experience supporting enterprise security operations or public sector environments. Knowledge of security frameworks, threat intelligence, and the MITRE ATT&CK framework. Experience integrating third-party security products and log sources with Microsoft Sentinel. Candidate Submission Interested candidates should submit an updated resume highlighting hands-on experience with Microsoft Sentinel, KQL, Defender XDR, Logic Apps playbooks, identity security, and incident response.