We are looking for a Microsoft Security Engineer to operate, administer and improve Microsoft Security Copilot and Defender for Endpoint in a large enterprise security environment. The split is about 80% BAU operations and 20% delivery and continuous improvement.

Key responsibilities

- Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
- Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
- Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
- Manage vulnerability exposure, IOCs, tuning and exclusions through change control
- Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
- Maintain runbooks, documentation, dashboards and audit evidence
- Support new use cases, automation, policy rollouts and the handover of projects into BAU

Key responsibilities

- Administer Security Copilot (standalone and embedded): RBAC, plugins, configuration, promptbooks and integrations across Defender XDR, Sentinel, Entra and Purview
- Monitor Security Compute Unit (SCU) capacity and consumption, service health and platform performance
- Run day-to-day Defender for Endpoint operations: onboarding, sensor health, coverage, policies (ASR, AV, EDR,



web/network protection, device control, tamper protection)
- Investigate endpoint alerts and incidents, threat hunt with KQL and coordinate remediation
- Manage vulnerability exposure, IOCs, tuning and exclusions through change control
- Handle ITIL incidents, requests, problems and changes to SLA, including Microsoft support cases
- Maintain runbooks, documentation, dashboards and audit evidence
- Support recent use cases, automation, policy rollouts and the handover of projects into BAU

Must have

- 5+ years in cyber security operations, endpoint security or Microsoft security engineering
- 3+ years hands-on with Defender for Endpoint / Defender XDR
- Hands-on Security Copilot experience, or an equivalent AI-enabled SecOps platform
- Strong KQL, threat hunting and incident investigation skills
- Experience in regulated, critical-service environments with formal change management

Certifications

- Required: SC-500 (Cloud and AI Security Engineer) or an equivalent current Microsoft security certification, plus Security Copilot training (e.g. SC-5006)
- Highly regarded: SC-200, SC-300, MD-102, SC-100, ITIL Foundation, responsible AI training

Additional information

- Full-time | Onsite/Hybrid | Critical Infrastructure
- Sydney OR Melbourne location

📌 Cyber Security Engineer (Sydney)
🏢 Luvo
📍 Sydney