Job Description – L2 Security Engineer (Implementation – Microsoft Sentinel & Defender Suite)
Role: L2 Security Implementation Engineer
Experience: 4+ Years required
Specialization: Microsoft Sentinel, Microsoft Defender XDR Suite
Job Type: Full‑Time, 9AM - 7PM from Office in Bangalore (Implementation / Delivery)
Job Summary
We are looking for a skilled L2 Implementation Engineer with 4–5 years of hands‑on experience deploying and configuring Microsoft Sentinel and Microsoft Defender products .
This role focuses entirely on implementation, onboarding, integrations, policy configuration, customer deployments, and technical project delivery —not SOC monitoring.
Key Responsibilities (Implementation‑Focused)
Microsoft Sentinel – Implementation
- Deploy and configure Log Analytics Workspace , data retention, workspace architecture.
- Onboard data sources using connectors (Azure services, M365, Defender, Syslog, CEF agents, firewalls, proxies, SaaS apps).
- Configure Log Analytics Agents / AMA on Windows, Linux, and network appliances.
- Implement workbooks , dashboards , and basic analytic rules as part of initial setup.
- Configure and test automation rules & SOAR Playbooks (Logic Apps) to meet customer use cases.
- Integrate Sentinel with:
- Microsoft Defender XDR
- Azure AD / Entra ID logs
- Azure Activity Logs
- On‑prem servers
- Firewalls (Palo Alto, Fortinet, Checkpoint)
Microsoft Defender Suite – Deployment & Configuration
Defender for Endpoint (MDE)
- Onboard Windows, macOS, Linux devices using onboarding scripts, Intune, Group Policy.
- Configure AV, EDR, ASR rules, firewall, network protection, web filtering, and device control.
- Build and deploy endpoint security baselines using Intune or GPO.
Defender for Identity (MDI)
- Deploy sensors on Domain Controllers.
- Configure directory services integration.
- Validate lateral movement and identity monitoring.
Defender for Cloud Apps (MDA/M365D Apps)
- Configure app connectors (O365, AWS, GCP, Salesforce, ServiceNow).
- Deploy session control, app discovery, conditional access app control.
- Enable policies for DLP, file governance, and compliance.
Defender for Office 365
- Configure Safe Links, Safe Attachments, anti‑phishing policies, impersonation protection.
- Integrate O365 signals with Sentinel.
Defender for Cloud (Azure Security Center)
- Configure subscriptions, security policies, recommendations & workload protections.
- Enable defender plans for VMs, storage, SQL, containers, key vault, etc.
Additional Responsibilities
- Gather customer requirements and convert them into technical implementation steps.
- Prepare HLD/LLD documentation, architecture diagrams, implementation plans.
- Perform POCs, pilots, environment assessments, and configuration validation.
- Troubleshoot onboarding issues, connector failures, integration errors.
- Conduct knowledge transfer (KT) sessions to customers post‑deployment.
- Work with Microsoft Intune for onboarding Defender & deploying policies (if required).
- Good Power shell and Linux scripting skills
Required Skills
- Strong experience implementing:
- Microsoft Sentinel
- Defender for Endpoint
- Defender for Identity
- Defender for Office 365
- Defender for Cloud Apps
- Defender for Cloud (Azure)
- Good hands‑on knowledge of:
- Azure Log Analytics
- KQL (basic‑intermediate for validation)
- Azure Logic Apps (SOAR playbooks)
- Azure AD / Entra ID logs
- Strong understanding of onboarding methods, connectors, log ingestion, and device integrations.
Preferred Qualifications
- Microsoft Certifications:
- SC‑200 (Security Operations Analyst) / SC‑300 / AZ‑500 / AZ-900
- Experience with firewalls, proxies, server logs, API integrations (for Sentinel connectors).
Soft Skills
- Strong communication and customer‑facing skills.
- Ability to work with delivery teams, architects, and customers.
- Good documentation skills (HLD/LLD, runbooks).
- Problem-solving skills and ownership mindset.