Systems Security Lead

The Systems Security Lead is responsible for the design implementation operation monitoring and continuous improvement of cybersecurity controls and security platforms managed by the Systems Team The role acts as the technical owner for Microsoft security and compliance solutions endpoint protection identity security data protection threat detection and incident response across Microsoft 365 Azure servers endpoints and collaboration platforms

• Lead daily security operations for systems managed by the Systems Team
• Monitor security alerts incidents vulnerabilities and misconfigurations across Microsoft 365 Azure Windows servers and endpoints
• Perform investigation threat hunting root cause analysis containment remediation and recovery activities
• Coordinate with infrastructure network endpoint and application teams during security incidents and high-risk changes

• Own and administer Microsoft Defender XDR capabilities including Defender for Endpoint Defender for Office 365 Defender for Identity Defender for Cloud Apps and Defender for Cloud Tune policies alert rules attack surface reduction controls automated investigation and remediation and endpoint security baselines
• Monitor EDR coverage antivirus status sensor health vulnerability exposure threat analytics and incident queues
• Prepare operational reports showing incidents vulnerabilities endpoint health and improvement actions

• Administer Microsoft Purview capabilities including Data Loss Prevention sensitivity labels information protection data classification retention audit eDiscovery insider risk and communication compliance
• Design and maintain DLP and information protection controls for Exchange Online SharePoint Online One Drive Teams and endpoints
• Review DLP alerts false positives policy effectiveness sensitive information types and user impact
• Support compliance evidence collection and audit readiness for data protection and information governance

• Administer endpoint protection platforms including Kaspersky Endpoint Security and Microsoft Defender Antivirus
• Ensure endpoint protection agents signatures policies device controls and anti-malware settings are healthy and up to date
• Manage malware response USB and device control endpoint hardening ransomware protection and suspicious activity investigation
• Coordinate endpoint security remediation with desktop server and infrastructure teams

• Monitor and support Microsoft Entra  controls, including MFA, Conditional Access, Identity Protection, privileged roles, and risky sign-ins.
• Support least privilege, zero trust, privileged access review, and access governance activities.
• Review administrative accounts, privileged role assignments, risky users, inactive accounts, and excessive access.
• Coordinate with system owners to remediate identity and access-related risks.

• Support internal policies, NCA ECC requirements, ISO 27001 practices, and Microsoft security best practices
• Maintain procedures, operational runbooks, evidence packs, control checklists, and audit documentation
• Review secure score, compliance score, configuration gaps, and security posture improvement plans
• Participate in security assessments, vendor reviews, and remediation tracking

• Education:
  
  Bachelor degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related discipline.
• Experience:
  
  Minimum 5 years systems security experience, including at least 3 years of hands-on Microsoft security administration.
• Environment:
  Practical experience securing Microsoft 365, Azure, Windows Server, endpoints, identity, collaboration, and compliance platforms.
• Leadership:
  Ability to lead technical activities, coordinate cross-team remediation, document findings, and communicate risks clearly to management.
• Working Relationships:
  Internal:
  Systems Team, Network Team, Service Desk, Applications Team, Cybersecurity Team, Governance and Compliance, and Business System Owners. External:
  Microsoft support, security solution vendors, managed service providers, auditors, and implementation partners.
• Role
  
  Summary:
  
  This role is intended to provide a dedicated technical lead for system-owned security tools and responsibilities, with strong emphasis on Microsoft Purview, Microsoft Defender, Kaspersky Endpoint Security, identity protection,…