← All roles

Security Operations Engineer

Microsoft· Security Operations Engineering
Apply on company site
Australia, NSW, Sydney, Australia, VIC, MelbourneFull-timePosted 2mo ago

About the role

Microsoft Cloud Operations & Innovation (CO+I) seeks a Security Operations Engineer to design, implement, and operate cloud and on-premises cybersecurity controls, lead incident response, threat detection, and security automation in a large-scale environment supporting Microsoft services.

Responsibilities

  • Lead and participate in security incident investigations across cloud, on-premises, and hybrid environments, including high-severity events and major incidents.
  • Coordinate investigation and response activities with engineering, platform, identity, network, application and other partner teams.
  • Develop and maintain incident response playbooks, procedures and operational runbooks.
  • Improve Cyber Defense capabilities through process optimization, automation, lessons learned and recommendations that reduce security exposure.
  • Monitor, investigate and respond to security alerts using Microsoft Sentinel, Microsoft Defender XDR and other SIEM, EDR, and NDR technologies.
  • Analyze attempted and successful compromises, perform proactive threat hunting and develop response and mitigation recommendations with partner teams.
  • Create and tune detection rules, analytics, correlation logic and threat detection content using threat intelligence, indicators of compromise and adversary tactics, techniques and procedures.
  • Use operational metrics and security data to improve detection fidelity, response times, service health and customer and partner experience, escalating gaps and recommending improvements as appropriate.
  • Participate in an on-call rotation supporting security services and incident response.
  • Design and implement SOAR workflows, response automation, and operational tooling using PowerShell, Python, KQL, Logic Apps, Azure Functions, or equivalent technologies.
  • Integrate security technologies and telemetry sources into security operations platforms to reduce analyst effort and improve investigation and response outcomes.
  • Identify gaps and recurring issues in security controls, policies, and operational processes, then work with partner teams to implement consistent, scalable, and automated improvements.

Qualifications

  • 3+ years of experience in cybersecurity, Security Operations Center operations, incident response, Cyber Defense, Blue Team functions, large-scale computing, software development, or a related technical field; or a bachelor’s degree in computer science, Cybersecurity, Information Technology, Engineering, or equivalent experience.
  • Experience investigating security incidents such as malware, credential compromise, unauthorized access, insider threats, or related malicious activity.
  • Knowledge of the incident response lifecycle, security monitoring, threat detection, and SIEM, EDR, or SOAR technologies.
  • Experience with Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, Elastic, or comparable security platforms.
  • Hands-on experience with at least one scripting or security query language, such as KQL, PowerShell, or Python.
  • Understanding of network security and experience securing large-scale cloud environments, preferably Microsoft Azure.

Skills

Required:Incident responseThreat huntingSecurity automationScripting/query languages

Benefits

  • Career development opportunities including trainings and growth opportunities, certifications, and development programs.
Last updated Aug 20, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft