L1 Support SME – Microsoft Defender XDR

Job Description

We are seeking an experienced L1 Support SME – Microsoft Defender XDR Support to provide hypercare and operational support for Microsoft security platforms within a large enterprise environment.

The successful candidate will be responsible for issue intake, ticket triage, evidence collection, troubleshooting, escalation coordination, and stakeholder communication across Microsoft Defender for Endpoint (MDE), Microsoft Defender for Cloud Apps (MDCA), and Microsoft Purview.

• Provide Level 1 hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview.
• Perform issue intake, ticket review, categorization, prioritization, and impact assessment.
• Collect and analyze logs, screenshots, policy status, connector health information, validation outputs, and supporting evidence required for issue investigation.
• Support initial troubleshooting for Defender, Intune policy deployments, MDCA connectors, and Purview policy-related issues.
• Monitor and manage support tickets, ensuring timely updates, tracking, and closure of incidents.
• Coordinate escalations to L2/L3 support teams, SMEs, or client stakeholders when advanced investigation is required.
• Maintain accurate ticket documentation, issue summaries, remediation actions, and status reports.
• Follow established runbooks, support procedures, governance standards, and operational guidelines.
• Collaborate with Security Operations, Endpoint Management, Identity, Compliance, and Infrastructure teams to resolve issues effectively.
• Participate in hypercare activities and ensure adherence to agreed service levels and support processes.

• Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related discipline.
• Experience in L1 Support, Microsoft Security Operations, Endpoint Support, Service Desk Operations, or Microsoft 365 Support environments.
• Strong understanding of incident management, ticket lifecycle management, and escalation procedures.
• Excellent communication, documentation, and stakeholder management skills.
• Technical
  
  Skills:
  
  Microsoft Defender for Endpoint (MDE), Microsoft Defender for Cloud Apps (MDCA), Microsoft Purview, Microsoft Intune Endpoint Security, Support Incident & Ticket Management, ITSM Processes and Service Operations, Security.
• Monitoring and troubleshooting, evidence collection and root cause analysis.

• SC-200:
  Microsoft Security Operations Analyst
• MD-102:
  Endpoint Administrator
• SC-900:
  Security, Compliance, and Identity Fundamentals
• AZ-500:
  Azure Security Engineer Associate
• SC-300:
  Identity and Access Administrator
• SC-401:
  Information Security Administrator

• Experience supporting enterprise Microsoft security environments.
• Exposure to Microsoft Defender XDR platforms and post-go-live hypercare support.
• Experience working within regulated or highly governed enterprise environments.
• Familiarity with ITSM tools, support queues, incident tracking systems, and structured escalation frameworks.
• Experience collaborating with SOC, Compliance, Identity, Endpoint, and Infrastructure teams.