Administrator, Microsoft 365 Cybersecurity

Job Purpose: (Why does the job exist?)

Administer, configure, monitor, and continuously improve security and data-protection controls across the Microsoft 365 environment. Act as the primary administrator for Microsoft Defender and Microsoft Purview, protecting corporate endpoints, identities, email, collaboration services, and sensitive information while coordinating with Cybersecurity, SOC, IAM, and Infrastructure teams.

Person Specifications: (Minimum attributes for the job holder to be effective in this job)Basic Academic Qualification

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.

Preferred Qualification

Master’s degree in Computer Science, Information Technology, or a related discipline with relevant professional certification preferred.

Technical Certifications

• SC-200 - Security Operations Analyst

• SC-300 - Identity and Access Administrator

• SC-400 - Information Protection Administrator

• SC-100 - Cybersecurity Architect

• Other relevant Microsoft 365 / Azure security certifications

Experience

• Minimum 3-5 years of experience in IT, Microsoft 365, or cybersecurity.

• Minimum 2-3 years of hands-on experience with Microsoft 365 security technologies.

Specific Industry Experience

Experience supporting enterprise Microsoft 365 environments and working with SOC, IAM, endpoint, cybersecurity, and infrastructure teams.

Computer Skills

Strong practical experience with: Microsoft Defender XDR, Endpoint, Office 365, Identity, and Cloud Apps; Microsoft Purview - DLP, Sensitivity Labels and eDiscovery; Microsoft Entra ID

Microsoft Intune; PowerShell; Kusto Query Language (KQL)

Language Proficiency

Excellent proficiency in Business English, including the ability to interpret technical requirements, prepare system documentation, and communicate effectively with technical and functional stakeholders.

Competencies/Skills

• Microsoft 365 Security Administration
• Incident Investigation & Response
• Endpoint & Data Security Troubleshooting
• Technical Requirement Translation
• Documentation & Reporting

Work Environment & Physical Effort

Primarily office-based, involving extensive use of computers and security administration tools, with regular interaction with technical, functional, and business teams.

Supervision Received (Job title of this position’s immediate Superior)Manager, Infrastructure Operations Supervision Given (if any, job title/s of subordinates for this position)

None

Communications: (job title, department, and entities with which the position has an interface)Internal:

Cybersecurity, SOC, IAM, Infrastructure, Digital Workplace, and GRC teams.

External:

Microsoft Support, security technology vendors, and consultants.

Job Authority / Other Factors: (Decision-making authority, resources controlled, operational, financial, administrative functions, or any special distinct requirement for the job as required)

Implement and modify approved security policies and configurations, remediate device vulnerabilities, manage data-loss prevention controls, and isolate compromised endpoints in accordance with approved cybersecurity standards and delegated access rights.

KEY RESULTS AREAS (KRA) (What areas or major activities will produce the contributions that the company expects from this job holder?)

• LIST OF RESPONSIBILITIES (Routine and non-routine tasks that have to be performed to achieve the KRA identified. Highlight the result that is expected from each task)

1

Microsoft 365 Security & Endpoint Protection: Administer and strengthen Microsoft 365 security controls to protect identities, endpoints, email, applications, and cloud services.

• Administer Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps.

• Manage endpoint security controls including Defender Antivirus, ASR, BitLocker, removable-media restrictions, and network/web protection.

• Monitor Microsoft Secure Score and review security configurations across Entra ID, Exchange, SharePoint, OneDrive, Teams, and Intune.

• Support Conditional Access, MFA, Identity Protection, Privileged Identity Management (PIM), and Zero Trust principles.

• Identify configuration and endpoint vulnerabilities and coordinate timely remediation.

2

Data Protection, Compliance & Governance: Protect sensitive corporate information and maintain effective information-protection and compliance controls.

• Configure and manage Microsoft Purview, Sensitivity Labels, Information Protection, and Data Loss Prevention (DLP) policies.

• Administer Insider Risk Management, Communication Compliance, eDiscovery, and Audit requirements.

• Investigate data-loss incidents, unauthorized information sharing, and related policy violations.

• Coordinate with GRC, Legal, HR, and business stakeholders on information-protection and data-classification requirements.

• Provide technical evidence and support for internal and external security audits.

3

Security Monitoring & Incident Response: Detect, investigate, contain, and remediate Microsoft 365 security threats and incidents.

• Monitor Defender XDR alerts covering endpoint, identity, email, and cloud security events.

• Investigate malicious emails, compromised endpoints, identities, and other security events.

• Conduct proactive threat hunting and root-cause analysis using KQL and Advanced Hunting.

• Coordinate with the SOC and relevant technical teams on incident containment, remediation, and recovery.

• Maintain incident-response procedures and runbooks and recommend preventive actions based on incident findings.

4

Security Integration, Automation & Continuous Improvement: Improve security operations through system integration, automation, and enhancement of Microsoft 365 security controls.

• Support integration of Microsoft Defender with Microsoft Sentinel and other approved SIEM/SOC platforms.

• Use PowerShell to automate Microsoft 365 security-administration activities.

• Support Microsoft Graph-based security administration and integrations.

• Coordinate with cross-functional IT teams to implement security controls and enhancements.

• Identify opportunities to improve security configurations, workflows, monitoring, and administrative efficiency.

5

Security Reporting & Documentation: Provide visibility of the Microsoft 365 security posture and maintain accurate operational and technical documentation.

• Prepare reports covering Defender incidents, endpoint security posture, Secure Score, DLP incidents, vulnerabilities, and policy violations.

• Maintain technical documentation, configuration standards, operational procedures, and security runbooks.

• Document security changes, exceptions, incidents, and corrective actions.

• Maintain appropriate security records and supporting evidence for governance and audit requirements.

• Recommend continuous improvements based on security trends, incidents, vulnerabilities, and control performance.

6

HSE Responsibility: Perform assigned responsibilities in accordance with company Health, Safety, and Environmental requirements.

• Comply with applicable HSE policies, procedures, and workplace requirements.

• Participate in mandatory HSE training and awareness activities.

• Report hazards, incidents, and unsafe conditions promptly.

• Maintain a safe and ergonomically appropriate workstation.

• Protect company systems, information, equipment, and other resources in accordance with established requirements.