Security Engineer - XDR (Lead)

Experience

Minimum 5+ years

Employment Type

Full-time

Location

Onsite / Remote (as per business need)

Job Summary

We are looking for a Senior Microsoft XDR Deployment Engineer with strong hands-on experience in deploying and managing Microsoft security solutions in enterprise environments.

The candidate will be responsible for implementing, configuring, and supporting Microsoft XDR solutions, working closely with customers and internal teams to ensure secure and successful deployments.

This role requires a senior, delivery-focused professional who can independently manage deployments from planning to production.

Key Responsibilities

Microsoft XDR Deployment & Implementation

• Lead end-to-end deployment of Microsoft XDR solutions across enterprise environments.
• Deploy and configure:
  • Microsoft Defender for Endpoint (Windows, Linux, macOS, Servers)
  • Microsoft Defender for Office 365
  • Microsoft Defender for Identity (MDI) including sensor deployment and gMSA configuration
  • Microsoft Defender for Servers
  • Microsoft Defender for Cloud (Security posture management, workload protection)
• Onboard endpoints and servers using Intune, GPO, scripts, MDE onboarding packages, and Azure Arc.
• Configure Attack surface reduction (ASR), EDR policies, AV policies, firewall rules, and device control.
• Migration skill set from 3rd party to Microsoft XDR.
• Experience with Enterprise-scale deployments (500+ endpoints/servers).
• Strong understanding of EDR, XDR, Identity security, Email security, and Cloud security.
• Email Records Migration skills like MX, SPF, DKIM and DMARC.
• Implement Email security policies including anti-phishing, anti-spam, Safe Links, Safe Attachments.
• Configure Identity protection features and advanced detections in Defender for Identity.
• Strong understanding in Active Directory(DC), Mac OS & Linux.
• Enable and fine-tune cloud workload protections for Azure, hybrid, and multi-cloud environments.
• Create deployment documents, standard operating procedures (SOPs), and reports
• Support security operations and incident investigations when required
• Troubleshoot deployment and onboarding issues related to:
  • Sensors, agents, extensions, policies, and connectivity
  • Defender services on endpoints, servers, and domain controllers
• Resolve conflicts with existing security tools (AV, EDR, proxy, firewall).
• Provide L3 support during POC, pilot, and production rollout phases.
• Support incident response and advanced threat investigations when required.

Certifications (Preferred)

• Microsoft SC-200 (Security Operations Analyst)
• Microsoft SC-300 (Identity and Access Administrator)
• Microsoft AZ-500 (Azure Security Engineer)
• Microsoft Defender / Security specialization certifications
• Any relevant cybersecurity certifications are an advantage