Full-time | Onsite/Hybrid | Critical Infrastructure
Sydney OR Melbourne location

We are looking for a Microsoft Security Engineer to operate, administer and improve Microsoft Security Copilot and Defender for Endpoint in a large enterprise security environment. The split is about 80% BAU operations and 20% delivery and continuous improvement.

Key Responsibilities
Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
Run day-to-day Defender for Endpoint operations: onboarding, sensor health, coverage, policies (ASR, AV, EDR, web/network protection, device control, tamper protection)
Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
Manage vulnerability exposure, IOCs, tuning and exclusions through change control
Handle ITIL incidents, requests, problems and changes to SLA,



including Microsoft support cases
Maintain runbooks, documentation, dashboards and audit evidence
Support recent use cases, automation, policy rollouts and the handover of projects into BAU

Must have
5+ years in cyber security operations, endpoint security or Microsoft security engineering
3+ years hands-on with Defender for Endpoint / Defender XDR
Hands-on Security Copilot experience, or an equivalent AI-enabled SecOps platform
Robust KQL, threat hunting and incident investigation skills
Experience in regulated, critical-service settings with formal change management

Certifications
Required: SC-500 (Cloud and AI Security Engineer) or an equivalent current Microsoft security certification, plus Security Copilot training (e.g. SC-5006)
Highly regarded: SC-200, SC-300, MD-102, SC-100, ITIL Foundation, responsible AI training

📌 Cyber Security Engineer Ms Stack Sydney (Australia)
🏢 luvo Talent
📍 Australia