{"id":2814742,"url":"https://alion.io/job/microsoft-security-operations-engineer","title":"Security Operations Engineer","company":{"id":18,"name":"Microsoft","domain":"microsoft.com","url":"https://alion.io/company/microsoft","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Eightfold","truth_index":{"grade":"B","score":82,"open_postings":337,"ghost_share":0,"stale_share":0.727,"repost_share":0.009,"time_to_fill_p50_days":29,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia","Melbourne, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":64000,"max_usd":155000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"OneDrive","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"closed","first_seen_at":"2026-08-14T19:25:33Z","employer_posted_date":"2026-08-18","last_verified_at":"2026-10-26T18:21:49Z","board_verified":false,"closed_at":"2026-10-26T18:21:49Z","days_open":72,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":72},"description":"OverviewIn alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day and we need you as a Security Operations Engineer.\nMicrosoft’s Cloud Operations & Innovation (CO+I) is the engine that powers our cloud services. As a Security Engineer you will perform a key role in delivering the core infrastructure and foundational technologies for Microsoft's online services including Bing, Office 365, Xbox, OneDrive, and the Microsoft Azure platform. You will implement and operate modern cloud and on premises cybersecurity controls to defend Microsoft datacenter critical infrastructure from threat actors. Leveraging multiple solutions and partnering with internal and external teams, you will be at the forefront of advancing industrial network cybersecurity capabilities.\nThrough on the job learning and bi-directional mentorship, this opportunity will allow you to gain cyber defense, automation, and networking skills and experiences that are rare in both networking and security organizations, and in high demand across multiple industries. This is a flexible work opportunity for you to work from home partially or fully if desired. As a group, CO+I is focused on personal and professional development for all employees and offers trainings and growth opportunities including Career Rotation Programs, Diversity & Inclusion trainings and events, and professional certifications.\nOur infrastructure is comprised of a large global portfolio of more than 100 datacenters and 1 million servers. Our foundation is built upon and managed by a team of subject matter experts working to support services for more than 1 billion customers and 20 million businesses in over 90 countries worldwide.\nWith environmental sustainability and optimization at the forefront of our datacenter design and operations, we continue to grow and evolve as we meet the ever-changing business demands that hold Microsoft as a world-class cloud provider.\nDo you want to empower billions across the world? Come and join us in CO+I and be at the forefront of the action!\nResponsibilities\nResponsibilities:\nIncident Response Cyber Defense\nLead and participate in security incident investigations across cloud, on-premises, and hybrid environments, including high-severity events and major incidents.\nCoordinate investigation and reponse activites with engineering, platrom, indentity, network, application and other partner teams.\nDevelop and maintain incident response playbooks, procedures and operational runbooks.\nImprove Cyber Defense capabilities through process optimization, automation, lessons learned and recommendations that reduce security exposure.\nThreat Detection & Security Operations\nMonitor, investigate and respond to security alerts using Microsoft Sentinel, Microsoft Defender XDR and other SIEM, EDR, and NDR technologies.\nAnalyze attempted and successful compromises, perform proactive threat hunting and develop response and mitigation recommendations with partner teams.\nCreate and tune detection rules, analytics, correlation logic and threat detection content usinf threat intelligence, indicators of compromise and adversary tactics, techniques and procedures.\nUse operational metrics and security data to improve detection fidelity, response times, service health and customer and partner experience, escalating gaps and recommending improvements as appropriate.\nParticipate in an on-call rotation supporting security services and incident response.\nSecurity Automation & Engineering\nDesign and implement SOAR workflows, response automation, and operational tooling using PowerShell, Python, KQL, Logic Apps, Azure Functions, or equivalent technologies. \nIntegrate security technologies and telemetry sources into security operations platforms to reduce analyst effort and improve investigation and response outcomes. \nIdentify gaps and recurring issues in security controls, policies, and operational processes, then work with partner teams to implement consistent, scalable, and automated improvements. \nOther\nEmbody our culture and values.\n\nQualifications\nRequired Qualifications:\n3+ years of experience in cybersecurity, Security Operations Center operations, incident response, Cyber Defense, Blue Team functions, large-scale computing, software development, or a related technical field;\n\norA bachelor’s degree in computer science, Cybersecurity, Information Technology, Engineering, or a related field, or equivalent experience.\n\nExperience investigating security incidents such as malware, credential compromise, unauthorized access, insider threats, or related malicious activity.\n\nKnowledge of the incident response lifecycle, security monitoring, threat detection, and SIEM, EDR, or SOAR technologies.\n\nExperience with Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, Elastic, or comparable security platforms.\n\nHands-on experience with at least one scripting or security query language, such as KQL, PowerShell, or Python.\n\nUnderstanding of network security and experience securing large-scale cloud environments, preferably Microsoft Azure.\n\nBackground Check Requirements:\nAbility to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:\nMicrosoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.\nWhile not required, we also look for the following Preferred Qualifications:\nCISSP, CISA, CISM, SANS, GCIA, GCIH, OSCP, PCCSE, PCNSE, PCSAE, CCNP Security, CCIE Security and/or Security+ certification.\nAny experience conducting investigations involving OT, manufacturing, critical infrasructure, energy or industrial enviroments is highly preferred (not mandatory)\nExperience securing large-scale Microsoft Azure environments\nHands-on experience with multiple scripting or automation languages.\nThis position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.\nMicrosoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.","description_format":"text","description_chars":6953,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Growth opportunities","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Console Games","Gaming Consoles","Security Operations","Developer Tools"],"lifecycle":[{"event":"open","at":"2026-10-18T11:58:13Z"},{"event":"close","at":"2026-10-26T18:21:49Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/microsoft-security-operations-engineer","json_url":"https://alion.io/job/microsoft-security-operations-engineer.json","meta":{"generated_at":"2026-11-01T19:10:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29274,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18},"rest":"https://alion.io/mcp/rest/get_company?id=18"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmicrosoft-security-operations-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmicrosoft-security-operations-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmicrosoft-security-operations-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/microsoft-security-operations-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmicrosoft-security-operations-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2814742}},{"tool":"search_jobs","arguments":{"company":"microsoft.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2814742},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}