L2 Security Engineer (Implementation – Microsoft Sentinel & Defender Suite)

Job Description – L2 Security Engineer (Implementation – Microsoft Sentinel & Defender Suite) Role: L2 Security Implementation Engineer Experience: 4+ Years required Specialization: Microsoft Sentinel, Microsoft Defender XDR Suite Job Type: Full‑Time, 9AM - 7PM from Office in Bangalore (Implementation / Delivery) Job Summary We are looking for a skilled L2 Implementation Engineer with 4–5 years of hands‑on experience deploying and configuring Microsoft Sentinel and Microsoft Defender products .

This role focuses entirely on implementation, onboarding, integrations, policy configuration, customer deployments, and technical project delivery —not SOC monitoring.

Key Responsibilities (Implementation‑Focused)

Microsoft Sentinel – Implementation

• Deploy and configure Log Analytics Workspace, data retention, workspace architecture.

• Onboard data sources using connectors (Azure services, M365, Defender, Syslog, CEF agents, firewalls, proxies, SaaS apps).

• Configure Log Analytics Agents / AMA on Windows, Linux, and network appliances.

• Implement workbooks, dashboards, and basic analytic rules as part of initial setup.

• Configure and test automation rules & SOAR Playbooks (Logic Apps) to meet customer use cases.

• Integrate Sentinel with:

• Microsoft Defender XDR

• Azure AD / Entra ID logs

• Azure Activity Logs

• On‑prem servers

• Firewalls (Palo Alto, Fortinet, Checkpoint)

Microsoft Defender Suite – Deployment & Configuration Defender for Endpoint (MDE)

• Onboard Windows, macOS, Linux devices using onboarding scripts, Intune, Group Policy.
• Configure AV, EDR, ASR rules, firewall, network protection, web filtering, and device control.
• Build and deploy endpoint security baselines using Intune or GPO.

Defender for Identity (MDI)

• Deploy sensors on Domain Controllers.
• Configure directory services integration.
• Validate lateral movement and identity monitoring.

Defender for Cloud Apps (MDA/M365D Apps)

• Configure app connectors (O365, AWS, GCP, Salesforce, ServiceNow).
• Deploy session control, app discovery, conditional access app control.
• Enable policies for DLP, file governance, and compliance.

Defender for Office 365

• Configure Safe Links, Safe Attachments, anti‑phishing policies, impersonation protection.
• Integrate O365 signals with Sentinel.

Defender for Cloud (Azure Security Center)

• Configure subscriptions, security policies, recommendations & workload protections.
• Enable defender plans for VMs, storage, SQL, containers, key vault, etc.

Additional Responsibilities

• Gather customer requirements and convert them into technical implementation steps.
• Prepare HLD/LLD documentation, architecture diagrams, implementation plans.
• Perform POCs, pilots, environment assessments, and configuration validation.
• Troubleshoot onboarding issues, connector failures, integration errors.
• Conduct knowledge transfer (KT) sessions to customers post‑deployment.
• Work with Microsoft Intune for onboarding Defender & deploying policies (if required).
• Good Power shell and Linux scripting skills

Required Skills

• Strong experience implementing:

• Microsoft Sentinel

• Defender for Endpoint

• Defender for Identity

• Defender for Office 365

• Defender for Cloud Apps

• Defender for Cloud (Azure)

• Good hands‑on knowledge of:

• Azure Log Analytics

• KQL (basic‑intermediate for validation)

• Azure Logic Apps (SOAR playbooks)

• Azure AD / Entra ID logs

• Strong understanding of onboarding methods, connectors, log ingestion, and device integrations.

Preferred Qualifications

• Microsoft Certifications:

• SC‑200 (Security Operations Analyst) / SC‑300 / AZ‑500 / AZ-900

• Experience with firewalls, proxies, server logs, API integrations (for Sentinel connectors).

Soft Skills

• Strong communication and customer‑facing skills.
• Ability to work with delivery teams, architects, and customers.
• Good documentation skills (HLD/LLD, runbooks).
• Problem-solving skills and ownership mindset.