Senior Security Administrator, Microsoft

🔥 25 minutes ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Al Watania Information Systems (Wisys)

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 1999

💼 Consulting

🤝 B2B

🏢 Enterprise

Consulting • B2B • Enterprise

Al Watania Information Systems (WiSys) is a Riyadh-based Saudi IT services and consulting company (est. 2007) that implements and manages enterprise technology solutions, with a strong focus on SAP implementations and support. WiSys offers SAP S/4HANA (public and private), SAP SuccessFactors, SAP Ariba, SAP Business One and related SAP services (implementation, support, annual contracts), plus managed services including cloud hosting (AWS, Google Cloud), infrastructure and security management, backup/restore, and IT operations. They also provide application development (including low-code platforms), BI & data analytics, IT outsourcing, and proprietary products such as WiHR, Internal Audit Portal, Legal Management System, and Balanced Scorecards. WiSys highlights local Saudi presence with cross-industry experience, multiple SAP quality awards and recognitions (including SAP Expert Level), ISO 27001 certification, and partnerships with vendors like Cisco, Fortinet, CrowdStrike, Commvault, Rubrik, and Dell.

📋 Description

• M365 E5 Security Administration & Engineering • Identity & Access (Entra ID): Configure and maintain Conditional Access policies, Multi-Factor Authentication (MFA), Privileged Identity Management (PIM), and Identity Protection rules. • Endpoint Security (Microsoft Defender for Endpoint & Intune): Manage EDR policies, device compliance rules, Attack Surface Reduction (ASR) rules, and automated remediation on Windows/mobile devices. • Email & Collaboration (Defender for Office 365): Oversee Safe Links, Safe Attachments, anti-phishing, anti-spam policies, and quarantine triage. • Data Protection & Governance (Purview): Implement and monitor Data Loss Prevention (DLP) policies, Sensitivity Labels, and Information Barrier policies across M365 services. • Cloud Apps (Defender for Cloud Apps): Monitor shadow IT, manage OAuth app permissions, and enforce session policies. • Microsoft Sentinel (SIEM/SOAR) Operations • Data Connector Management: Maintain and optimize log ingestion from M365, Entra ID, Defender XDR, firewalls, and cloud infrastructure while keeping ingestion costs efficient. • Detection & Analytics: Write and update KQL (Kusto Query Language) analytics rules, hunting queries, and custom workbooks/dashboards. • Automation (SOAR): Build and maintain Logic Apps playbooks to automate incident response workflows and threat containment. • Incident Response: Perform Tier 2/3 triage, investigation, and root-cause analysis on alerts originating from Defender XDR and Sentinel. • Operational Support & Maintenance (~300 Users) • License & Tenant Health: Continuously review Microsoft Secure Score, address recommendations, and audit user license assignments. • Patch & Vulnerability Management: Monitor Defender Vulnerability Management insights and coordinate with IT support to remediate endpoint software vulnerabilities. • User Escalations: Handle escalated support tickets regarding access blocks, false positives, quarantine releases, or compromised account recovery. • Reporting & Documentation: Maintain accurate security operational runbooks, architecture diagrams, and monthly threat/compliance reporting for management.

🎯 Requirements

• 3+ years of hands-on experience administering Microsoft 365 security features, specifically within an E5 / Defender XDR environment. • 3+ years of experience configuring and operating Microsoft Sentinel. • Strong proficiency in writing KQL (Kusto Query Language) queries for logs, investigations, and analytics rules. • Experience with Microsoft Intune (MDM/MAM) for Windows endpoint management. • Solid understanding of PowerShell for M365 scripting and security automation. • Hands-on knowledge of networking basics (DNS, Firewalls, VPNs) and cloud identity fundamentals (Entra ID, SAML, SSO). • Desirable Certifications (At least one preferred) • Microsoft Certified: Identity and Access Administrator Associate (SC-300) • Microsoft Certified: Information Protection and Governance Administrator Associate (SC-400) • Microsoft Certified: Security Operations Analyst Associate (SC-200) (Highly Desirable) • Microsoft Certified: Cybersecurity Architect Expert (SC-100)