Security Engineer (Microsoft Defender)

UltraViolet Cyber is seeking a Security Engineer (Microsoft Defender) to join their team in Arlington, VA. The successful candidate will serve as a subject matter expert for securing the Microsoft cloud tenant, advising on architecture, design, and implementation of secure solutions across Azure, O365, and M365.

Responsibilities:

• Serve as the go-to, subject matter expert (SME) for securing the Microsoft cloud tenant, advising on architecture, design, and implementation of secure solutions across Azure, O365, and M365.
• Lead the development and enforcement of Conditional Access Policies, aligned with best practices for managing access control for personas, groups, and applications.
• Act as the primary SME in optimizing the Microsoft Defender suite of components (Defender for Endpoint, Defender for Cloud, Defender for Identity, and Defender for Office 365)
• Implement Microsoft Purview, including data classification and sensitivity labels, Data Loss Prevent (DLP), and eDiscovery workflows.
• Design, run and optimize Kusto Query Language (KQL) queries for Azure Sentinel, Defender, and log analytics.
• Review and remediate security controls through vulnerability assessments, penetration tests, and red/blue team engagements.
• Guide cross-functional teams on security controls, compliance requirements, policy, and governance best practices

Requirements:

• Ability to Obtain DHS EOD Public Trust Clearance
• Master’s Degree + 10 years’ experience OR Bachelor’s degree + 13 years OR 19 years total experience
• Expert-level hands-on experience deploying, managing, and securing Azure, Entra, Defender, Purview, Office 365, and Microsoft 365 in large enterprises.
• Deep understanding of Conditional Access Policies (CAPs), Azure AD/Entra, and Zero Trust principles.
• Proven Track record implementing and managing the full suite of the Microsoft Defender ecosystem and Microsoft Purview (DLP, sensitivity labels, eDiscovery)
• Advanced proficiency writing KQL for detection, investigation, response, and reporting
• Active, expert-level certification such as Microsoft Certified Solutions Expert (MSCE), Microsoft 365 Admin Expert, Microsoft Cybersecurity Architect Expert, AZ-900, AZ-500, SC-900, SC-100, SC-200, SC-300, SC-400, SC-401
• Cybersecurity certifications: Security+
• Strong networking, firewall, VPN, and segmentation knowledge as it relates to cloud deployments
• Exceptional time management, written and communication skills.
• Participate in rotating on-call schedule across the team, to provide incident response or support during outages.

Desired:

• CISSP, OSCP, GCIH
• ITIL, Agile, or PMP familiarity/certification
• Experience with SOAR platforms (e.g. Splunk, Microsoft Sentinel)
• Hands-on exposure to third-party cloud security tooling (CASBs, CNAAPs, SD-WANs)
• Previous consulting or client-facing delivery experience