M365 E5 Security Administration & Engineering

The role involves comprehensive security administration and engineering within the M365 E5 environment, focusing on Identity & Access management, Endpoint Security, Email & Collaboration security, Data Protection & Governance, and Cloud Apps security. The responsibilities include configuring and maintaining Conditional Access policies and managing endpoint security protocols to ensure robust protection against threats.

Responsibilities

• Configure and maintain Conditional Access policies, Multi-Factor Authentication (MFA), Privileged Identity Management (PIM), and Identity Protection rules.
• Manage EDR policies, device compliance rules, and automated remediation on Windows/mobile devices using Microsoft Defender for Endpoint and Intune.
• Oversee Safe Links, Safe Attachments, anti-phishing, anti-spam policies, and quarantine triage within Defender for Office 365.
• Implement and monitor Data Loss Prevention (DLP) policies, Sensitivity Labels, and Information Barrier policies across M365 services.
• Monitor shadow IT, manage OAuth app permissions, and enforce session policies with Defender for Cloud Apps.
• Maintain and optimize log ingestion from M365, Entra ID, Defender XDR, and cloud infrastructure while keeping costs efficient.
• Write and update KQL (Kusto Query Language) analytics rules and perform Tier 2/3 triage, investigation, and root-cause analysis on alerts.
• Handle escalated support tickets regarding access blocks or compromised account recovery and maintain accurate security operational documentation.

Requirements

• 3+ years of hands-on experience administering Microsoft 365 security features, specifically within an E5 / Defender XDR environment.
• Strong proficiency in writing KQL queries for logs, investigations, and analytics rules.
• Experience with Microsoft Intune for Windows endpoint management.
• Solid understanding of PowerShell for M365 scripting and security automation.
• Knowledge of networking basics (DNS, Firewalls, VPNs) and cloud identity fundamentals (Entra ID, SAML, SSO).

Desirable Certifications

• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Information Protection and Governance Administrator Associate (SC-400)
• Microsoft Certified: Security Operations Analyst Associate (SC-200) (Highly Desirable)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)

Location
Riyadh, Saudi Arabia