" \u003cdiv class=\"ja-job-details\"\u003e \u003ch2 class=\"title\"\u003eCyber Security Engineer - MS Stack\u003c/h2\u003e \u003cdiv class=\"meta\"\u003e \u003cul class=\"classifications\"\u003e \u003cli data-id=\"18321\"\u003e Security \u003c/li\u003e \u003cli data-id=\"18323\"\u003e Sydney \u003c/li\u003e \u003cli data-id=\"18324\"\u003e Permanent - Full Time \u003c/li\u003e \u003c/ul\u003e \u003cp class=\"date-posted\"\u003e 4/11/2026 \u003c/p\u003e \u003c/div\u003e \u003cul class=\"bullet-points\"\u003e \u003cli\u003eFull-time | Onsite/Hybrid | Critical Infrastructure\u003c/li\u003e \u003cli\u003eSydney OR Melbourne location\u003c/li\u003e \u003c/ul\u003e \u003cdiv class=\"description\"\u003e We are looking for a Microsoft Security Engineer to operate, administer and improve Microsoft Security Copilot and Defender for Endpoint in a large enterprise security environment. The split is about 80% BAU operations and 20% delivery and continuous improvement.\u003cbr\u003e\u003cbr\u003e \u003cstrong\u003eKey responsibilities\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eAdminister Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview\u003c/li\u003e \u003cli\u003eMonitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance\u003c/li\u003e \u003cli\u003eRun day-to-day Defender for Endpoint operations: onboarding, sensor health, coverage, policies (ASR, AV, EDR, web/network protection, device control, tamper protection)\u003c/li\u003e \u003cli\u003eInvestigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation\u003c/li\u003e \u003cli\u003eManage vulnerability exposure, IOCs, tuning and exclusions through change control\u003c/li\u003e \u003cli\u003eHandle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases\u003c/li\u003e \u003cli\u003eMaintain runbooks, documentation, dashboards and audit evidence\u003c/li\u003e \u003cli\u003eSupport new use cases, automation, policy rollouts and the handover of projects into BAU\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eMust have\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003e5+ years in cyber security operations, endpoint security or Microsoft security engineering\u003c/li\u003e \u003cli\u003e3+ years hands-on with Defender for Endpoint / Defender XDR\u003c/li\u003e \u003cli\u003eHands-on Security Copilot experience, or an equivalent AI-enabled SecOps platform\u003c/li\u003e \u003cli\u003eStrong KQL, threat hunting and incident investigation skills\u003c/li\u003e \u003cli\u003eExperience in regulated, critical-service environments with formal change management\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eCertifications\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eRequired: SC-500 (Cloud and AI Security Engineer) or an equivalent current Microsoft security certification, plus Security Copilot training (e.g. SC-5006)\u003c/li\u003e \u003cli\u003eHighly regarded: SC-200, SC-300, MD-102, SC-100, ITIL Foundation, responsible AI training\u003c/li\u003e \u003c/ul\u003e \u003c/div\u003e \u003cdiv class=\"apply\"\u003e \u003ca class=\"back-link\" href=\"#\" title=\"Back to search results\"\u003eBack to search results\u003c/a\u003e \u003cinput type=\"button\" class=\"ja-button\" data-job-id=\"4483589\" value=\"Apply Now\" title=\"Apply Now\" /\u003e \u003c/div\u003e \u003c/div\u003e "