Senior Microsoft Security Administrator📣 Job Ad

About the Role

Al Watania Information Systems (Wisys) is seeking a Senior Microsoft Security Administrator to join its team in Riyadh, Saudi Arabia. This full-time role requires 5-10 years of experience and focuses on managing and enhancing the organization's Microsoft security posture across various platforms, ensuring robust protection and efficient operations.

Key Responsibilities: M365 E5 Security Administration

• Configure and maintain Conditional Access policies, Multi-Factor Authentication (MFA), Privileged Identity Management (PIM), and Identity Protection rules within Entra ID.
• Manage EDR policies, device compliance rules, Attack Surface Reduction (ASR) rules, and automated remediation for Windows and mobile devices using Microsoft Defender for Endpoint and Intune.
• Oversee Safe Links, Safe Attachments, anti-phishing, anti-spam policies, and quarantine triage within Defender for Office 365.
• Implement and monitor Data Loss Prevention (DLP) policies, Sensitivity Labels, and Information Barrier policies across M365 services using Purview.
• Monitor shadow IT, manage OAuth app permissions, and enforce session policies using Defender for Cloud Apps.

Key Responsibilities: Microsoft Sentinel Operations

• Maintain and optimize log ingestion from M365, Entra ID, Defender XDR, firewalls, and cloud infrastructure, ensuring efficient ingestion costs.
• Write and update KQL (Kusto Query Language) analytics rules, hunting queries, and custom workbooks/dashboards.
• Build and maintain Logic Apps playbooks to automate incident response workflows and threat containment (SOAR).
• Perform Tier 2/3 triage, investigation, and root-cause analysis on alerts originating from Defender XDR and Sentinel.

Key Responsibilities: Operational Support and Maintenance

• Continuously review Microsoft Secure Score, address recommendations, and audit user license assignments.
• Monitor Defender Vulnerability Management insights and coordinate with IT support to remediate endpoint software vulnerabilities.
• Handle escalated support tickets related to access blocks, false positives, quarantine releases, or compromised account recovery.
• Maintain accurate security operational runbooks, architecture diagrams, and monthly threat/compliance reporting for management.

Qualifications and Experience

• A minimum of 5 to 10 years of professional experience in Microsoft security administration and engineering.
• Demonstrated expertise in M365 E5 security features, including Entra ID, Defender for Endpoint, Defender for Office 365, Purview, and Defender for Cloud Apps.
• Proficiency in Microsoft Sentinel (SIEM/SOAR) operations, including KQL, data connector management, and automation with Logic Apps.
• Experience with operational support, vulnerability management, and security reporting.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia, focusing on supporting an environment with approximately 300 users.

Application Process

Interested candidates are invited to apply, demonstrating their relevant experience and qualifications for this role.