Purpose of the Role
Manage day-to-day security operations and access controls across the organization. Lead the SOC team, protect the Microsoft 365 environment, and make sure identity, endpoint and email security controls are working and improving.
Job Responsibilities (KRA)
Identity & Access Management (IAM)
- Manage user access lifecycle: joiners, movers and leavers.
- Run periodic access reviews and recertification.
- Enforce MFA, conditional access and role-based access controls.
- Work with HR and IT to close access gaps quickly.
Microsoft 365 Security
- Manage security settings across Entra ID, Exchange Online, SharePoint, Teams and OneDrive.
- Use Microsoft Defender, Purview and Secure Score to find and fix weaknesses.
- Monitor risky sign-ins, data sharing and configuration changes.
Privileged Access Management (PAM) and Privileged Identity Management (PIM)
- Manage privileged accounts, vaulting and session monitoring.
- Set up and manage just-in-time (JIT) access and approval workflows through PIM.
- Review privileged access regularly and remove standing admin rights.
SOC Operations
- Lead the SOC team and manage shifts, escalations and incident handling.
- Review alerts, investigate incidents and lead response to closure.
- Track SOC metrics such as MTTD, MTTR and false positive rate.
- Improve detection rules and response playbooks.
EDR/XDR
- Manage EDR/XDR tools (such as Microsoft Defender for Endpoint, CrowdStrike or SentinelOne).
- Make sure endpoint coverage is complete and policies are current.
- Lead threat hunting and containment of endpoint threats.
Email Security
- Manage email security controls: anti-phishing, anti-spam, SPF, DKIM, DMARC and safe links/attachments.
- Investigate phishing and business email compromise cases.
- Run phishing awareness campaigns with HR and Communications.
Governance and Reporting
- Prepare monthly security dashboards and incident reports for senior management.
- Support audits and compliance (ISO 27001, SOC 2 and other applicable standards).
- Coordinate with IT, Infra, Application and vendor teams on security fixes.
- Preferred certifications: CISSP, CISM, CEH, SC-200, SC-300, AZ-500, or equivalent
Job Requirements (KPI)
- Hands-on experience with IAM, PAM and PIM tools (such as Microsoft Entra ID, CyberArk, BeyondTrust).
- Strong knowledge of Microsoft 365 security.
- Working experience with a SIEM (Microsoft Sentinel, Splunk or QRadar).
- Practical experience with EDR/XDR tools.
- Good understanding of email security and phishing response.
- Incident response and investigation skills.
- Clear written and spoken communication with technical and non-technical teams
