Microsoft Security Engineer

King & Spalding is a leading global law firm with a commitment to excellence, innovation, and the seamless delivery of legal services. We harness innovative technology and exceptional talent to meet the complex needs of our clients in a fast-paced and dynamic legal landscape.

The Microsoft Security Engineer is responsible for designing, implementing, configuring, and maintaining enterprise security capabilities across the Microsoft security ecosystem. This role supports identity protection, endpoint security, cloud security, email security, data protection, threat detection, and security operations by using Microsoft technologies such as Microsoft Defender, Microsoft Sentinel, Microsoft Entra , Microsoft Purview, Microsoft Intune, and related Microsoft 365 security services.

KEY RESPONSIBILITIES:

Administer, configure, and optimize Microsoft security platforms, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, Microsoft Sentinel, Microsoft Entra , Microsoft Purview, and related security services.

Design and implement security policies, standards, controls, and configurations that reduce risk and improve the organization’s overall security posture.

Manage identity and access security controls, including creating conditional access policies.

Support endpoint, email, identity, cloud application, and data protection security operations through effective security policies.

Develop and maintain detection logic, alert rules, automation, playbooks, dashboards, and operational procedures within Microsoft Sentinel and Microsoft Defender.

Partner with threat response, detection engineering, infrastructure, endpoint, messaging, and compliance teams to improve prevention, detection, response, and recovery capabilities.

Perform security health checks, configuration reviews, control validation, and hardening activities across Microsoft 365, Azure, endpoint, identity, email, and SaaS environments.

Support investigations associated with phishing, malware, account compromise, suspicious authentication, data exposure, endpoint threats, and cloud-based threats.

Analyze logs, alerts, telemetry, indicators of compromise, and threat intelligence to identify suspicious behavior and partner with detection engineering teams create proactive alerts.

Stay current on Microsoft security capabilities, emerging cyber threats, industry best practices, and regulatory or compliance requirements affecting enterprise security operations.

Participate in change management, security projects, audit support, vulnerability remediation, and after-hours incident response or on-call coverage as required.

QUALIFICATIONS:

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field; equivalent professional experience may be considered in lieu of a degree.

Minimum of 3–5 years of experience in information security, security engineering, security operations, cloud security, identity security, endpoint security, or a related IT security role.

Hands-on experience administering or supporting Microsoft security technologies, such as Microsoft Defender, Microsoft Sentinel, Microsoft Entra , Microsoft Purview, Microsoft Intune, Microsoft 365 security, or Azure security services.

Strong understanding of cybersecurity principles, including defense-in-depth, least privilege, identity and access management, endpoint protection, email security, cloud security, vulnerability management, logging, monitoring, and incident response.

Experience configuring and maintaining security policies, conditional access rules, authentication controls, endpoint security baselines, data protection…