The role involves comprehensive security administration and engineering within the M365 E5 environment, focusing on Identity & Access management, Endpoint Security, Email & Collaboration security, Data Protection & Governance, and Cloud Apps security. The responsibilities include configuring and maintaining Conditional Access policies and managing endpoint security protocols to ensure robust protection against threats.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Responsibilities
- Configure and maintain Conditional Access policies, Multi-Factor Authentication (MFA), Privileged Identity Management (PIM), and Identity Protection rules.
- Manage EDR policies, device compliance rules, and automated remediation on Windows/mobile devices using Microsoft Defender for Endpoint and Intune.
- Oversee Safe Links, Safe Attachments, anti-phishing, anti-spam policies, and quarantine triage within Defender for Office 365.
- Implement and monitor Data Loss Prevention (DLP) policies, Sensitivity Labels, and Information Barrier policies across M365 services.
- Monitor shadow IT, manage OAuth app permissions, and enforce session policies with Defender for Cloud Apps.
- Maintain and optimize log ingestion from M365, Entra ID, Defender XDR, and cloud infrastructure while keeping costs efficient.
- Write and update KQL (Kusto Query Language) analytics rules and perform Tier 2/3 triage, investigation, and root-cause analysis on alerts.
- Handle escalated support tickets regarding access blocks or compromised account recovery and maintain accurate security operational documentation.
Requirements
- 3+ years of hands-on experience administering Microsoft 365 security features, specifically within an E5 / Defender XDR environment.
- Strong proficiency in writing KQL queries for logs, investigations, and analytics rules.
- Experience with Microsoft Intune for Windows endpoint management.
- Solid understanding of PowerShell for M365 scripting and security automation.
- Knowledge of networking basics (DNS, Firewalls, VPNs) and cloud identity fundamentals (Entra ID, SAML, SSO).
Desirable Certifications
- Microsoft Certified: Identity and Access Administrator Associate (SC-300)
- Microsoft Certified: Information Protection and Governance Administrator Associate (SC-400)
- Microsoft Certified: Security Operations Analyst Associate (SC-200) (Highly Desirable)
- Microsoft Certified: Cybersecurity Architect Expert (SC-100)
Location
Riyadh, Saudi Arabia
