Security Consulting Practitioner (Practitioner)

Job Description:

• Experienced in L1 Microsoft support engineering, endpoint security support, Defender ticket triage, and client-facing operational coordination.
• Providing hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview in a large enterprise environment.
• Focus on issue intake, initial triage, evidence collection, ticket updates, runbook-based support, and escalation coordination.
• Provide L1 hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview issues raised through the agreed support process.
• Perform first-level issue intake, ticket review, basic categorization, user impact capture, and prioritization based on available evidence and support guidance.
• Collect screenshots, logs, connector status, device policy status, policy status, validation outputs, and other supporting evidence required for issue review.
• Support basic troubleshooting discussions for MDE policy deployment through Intune, MDCA connectors, data sources, policy behavior, and Purview policy behavior.
• Track hypercare issues, actions, updates, closure status, and handoffs in the agreed issue tracker or support channels.
• Coordinate escalation to L2/L3, SMEs, or client IT teams where issues require deeper investigation, advisory review, or production configuration changes.
• Maintain clear ticket notes, issue summaries, support evidence, and daily status updates aligned to agreed support windows and workstream limits.

Requirements:

• Experience in L1 support, security platform support, endpoint support, service desk coordination, or Microsoft 365 operational support.
• Working knowledge of Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview support concepts.
• Understanding of issue intake, ticket triage, evidence collection, support documentation, escalation management, and issue lifecycle tracking.
• Familiarity with MDE policy deployment via Intune, MDCA connector or policy status, and Purview IP, DLP, IRM, or DLM policy support areas.
• Ability to follow runbooks, support guides, signed-off design guidance, and agreed hypercare procedures without making unsupported production changes.

Consulting and delivery skills:

• Able to work with client support teams, SOC, endpoint, Intune, identity, compliance, and operations teams.
• Clear communicator with strong ticket discipline, attention to evidence quality, and the ability to escalate issues promptly while keeping stakeholders informed.

Qualifications:

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field is preferred.
• Desirable Microsoft certifications include SC-200, MD-102, SC-900, AZ-500, SC-300, SC-401.

Preferred experience:

• Experience in enterprise Microsoft security support environments.
• Exposure to Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview hypercare or post-go-live support.
• Experience supporting regulated enterprise environments is advantageous.
• Experience working with ITSM processes, support queues, issue trackers, and structured escalation paths is beneficial.