Microsoft Defender Specialist

We are currently seeking an experienced Microsoft Defender Specialist for one of our large enterprise clients to help strengthen their cyber defense capabilities across Microsoft 365 and Azure environments.

You will be responsible for deploying, configuring, optimising, and monitoring the full Microsoft Defender suite (Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps) and integrating it with our SIEM and SOC workflows.

This role requires strong technical expertise, hands-on tuning of detection and prevention rules, and the ability to collaborate with SOC analysts, incident responders, and security architects to enhance our security posture in compliance with NIS2, ISO 27001, and GDPR.

Key Responsibilities

• Deploy and configure Microsoft Defender products across the organisation.
• Optimise policies, detection rules, and security baselines for Defender for Endpoint, Office 365, Identity, and Cloud Apps.
• Integrate Microsoft Defender alerts with SIEM platforms (Microsoft Sentinel, Splunk, QRadar) for advanced correlation and incident handling.
• Monitor security alerts, investigate incidents, and perform root cause analysis.
• Develop and maintain KQL queries, analytics rules, and hunting queries in Microsoft Sentinel.
• Conduct health checks and performance tuning of Defender components to ensure optimal protection.
• Provide recommendations for security improvements and automation opportunities.
• Create documentation, SOPs, and knowledge transfer materials for security teams.
• Support compliance efforts by ensuring Microsoft Defender configurations meet regulatory requirements (NIS2, ISO 27001, GDPR).

Required Skills & Experience

• 3+ years of experience managing Microsoft Defender solutions in enterprise environments.
• Strong knowledge of Microsoft 365 E5 security stack and Azure Security Center.
• Proficiency in Kusto Query Language (KQL) for advanced threat hunting and detection logic.
• Experience integrating Defender alerts into SIEM/SOC workflows.
• Hands-on expertise in threat investigation, incident response, and policy tuning.
• Familiarity with zero trust principles and endpoint hardening best practices.
• Understanding of compliance frameworks (NIS2, ISO 27001, GDPR).
• Fluent in English (Dutch is a strong plus).

Preferred Qualifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500).
• Experience with automation via PowerShell or Logic Apps.
• Familiarity with MITRE ATT&CK mapping for Microsoft Defender alerts.