Security Analyst

Job Description Key Responsibilities Microsoft Defender Suite Design and implement automated alert response playbooks in Defender; deploy automated containment for account compromise and identity-based threats via Entra ID Protection Configure Defender for Cloud Apps, Defender for Cloud, and Defender for Identity across the environment Tune detection rules and improve signal quality through KQL-based custom detection rules Entra Identity Security & Phishing-Resistant MFA Own deployment and enforcement of phishing-resistant MFA including passkey implementation strategy and rollout Configure and maintain Conditional Access policies with documented logic, exceptions, and recertification schedules; manage Entra ID security posture including risk-based authentication and identity protection Multi-Cloud Security Posture Management Assess and document security configurations across Azure and AWS; maintain Oracle Cloud environment (legacy, maintenance-mode); produce baseline documents covering current state, gaps, and risk for each platform Collaborate with IT to drive gap remediation; evaluate environments against industry frameworks Security Operations Participate in the alert response queue within published SLA windows Maintain the team's alert response SOP library AI-Augmented Security Lead deployment and integration of Microsoft Security Copilot into team investigation and triage workflows Research, evaluate, and implement emerging AI security tools with practical operational value; establish QA practices for AI-generated output and serve as the team's internal AI security subject matter expert Documentation Maintain documentation of security configurations, detection logic, and incident response procedures; translate findings into business risk language for leadership Required Qualifications Demonstrated hands‑on experience with the Microsoft Defender suite — Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Cloud Working experience with Microsoft Entra ID, Conditional Access policy design, and identity security configuration Familiarity with phishing-resistant authentication — passkeys, FIDO2, or certificate-based authentication in an enterprise environment Proficiency in KQL for alert logic and detection rule development; PowerShell or Python a plus Security operations experience — alert triage, incident response, SLA-based response discipline Demonstrated ability to leverage AI security tools as operational accelerators; Microsoft Security Copilot familiarity preferred Bachelor's degree in Cybersecurity, Computer Science, or Information Technology; equivalent experience considered Preferred Microsoft Sentinel and Defender portal integration; Defender Cases or comparable case management experience; hands‑on Microsoft Security Copilot experience including prompt engineering for security investigations Experience with cloud security across Microsoft Azure and AWS; Oracle Cloud familiarity a plus CrowdStrike Falcon familiarity; post-breach or PCI DSS compliance environment experience Certifications: SC-200, SSCP, CCSP, or comparable What We're Looking For Initiative and reliability — closes gaps without prompting; takes ownership of a problem and drives it to resolution independently; brings new knowledge back as practical application, not just awareness; communicates blockers before deadlines, not after Breadth with depth — strong in Defender and Entra identity with real capability across cloud security and security operations AI-forward mindset — evaluates tools critically, implements them practically, treats AI as a force multiplier Communication — translates technical findings for both technical peers and non-technical leadership About the Team Our Cybersecurity & Compliance team protects a multi-cloud enterprise environment spanning Microsoft Azure, AWS, and Oracle Cloud. This is a hands-on engineering and operations role — not a monitoring and reporting function. The right person enjoys building and running security solutions, leads incident response when it matters, and takes ownership of the platforms they manage. We are expanding Defender coverage, deploying phishing-resistant authentication, and implementing Microsoft Security Copilot, and this role leads all of it. We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to View email address on click.appcast.io learn more about how we collect, keep, and process your private information, please review Insight Global's Workforce Privacy Policy: Skills and Requirements Demonstrated hands‑on experience with the Microsoft Defender suite — Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Cloud Working experience with Microsoft Entra ID, Conditional Access policy design, and identity security configuration Familiarity with phishing-resistant authentication — passkeys, FIDO2, or certificate-based authentication in an enterprise environment Proficiency in KQL for alert logic and detection rule development; PowerShell or Python a plus Security operations experience — alert triage, incident response, SLA-based response discipline Demonstrated ability to leverage AI security tools as operational accelerators; Microsoft Security Copilot familiarity preferred Bachelor's degree in Cybersecurity, Computer Science, or Information Technology; equivalent experience considered • Microsoft Sentinel and Defender portal integration; Defender Cases or comparable case management experience; hands‑on Microsoft Security Copilot experience including prompt engineering for security investigations Experience with cloud security across Microsoft Azure and AWS; Oracle Cloud familiarity a plus CrowdStrike Falcon familiarity; post-breach or PCI DSS compliance environment experience Certifications: SC-200, SSCP, CCSP, or comparable #J-18808-Ljbffr