This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
The Security Operations Engineer will join the IAM Protect team within the CISO organization, supporting identity and access management (IAM) security operations across Microsoft’s cloud environments. Our organization leads the Tenant Isolation pillar within our Secure Future Initiative. This team within IAM Protect focuses in the productivity tenant space with an amplified focus on integrating AI into our day-to-day workstreams to: reduce manual touchpoints, identify gaps in security risk scopes, relentlessly pursue progress for key SFI initiatives in the tenant isolation space, and ensure our workstreams accrue to impact while striving to strengthen identity protection controls.
Job Responsibility:
Implement and enforce identity protection controls
Drive operational execution of IAM security policies (e.g., Conditional Access, MFA, token protection) to reduce lateral movement and credential compromise risks.
Collaborate on Secure Future Initiative (SFI) objectives
Partner with engineering and program teams to deliver SFI milestones such as phish-resistant MFA, token protection, conditional access policies, and legacy domain deprecation in productivity tenants.
Automate and optimize security workflows
In partnership with senior engineers and PMs, identify opportunities for automation and AI-native solutions to reduce manual touchpoints and improve efficiency in tenant governance and isolation processes.
Analyze telemetry and KPIs to drive risk reduction
Use data from S360 dashboards, Geneva logs, and other sources to track compliance, detect drift, and report progress against isolation and identity hardening goals.
Support tenant lifecycle security operations
Execute secure onboarding, baseline enforcement, and drift correction for auxiliary and ephemeral tenants
ensure alignment with IAM Protect governance standards.
Partner across teams for incident response and escalation
Work with internal stakeholders to push fixes into production environments, burn down active risk, and maintain readiness for high-severity incidents impacting tenant isolation.
Embody our culture and values
Requirements:
Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 1+ year(s) experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), OR operations incident response OR Bachelor's Degree in Statistics, Mathematics, Computer Science, OR related field AND 2+ years’ experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response OR equivalent experience.
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role.
This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Nice to have:
Experience with cloud IAM platforms (Azure AD, Entra ID, etc.)
Familiarity with SIEM, SOAR, and security automation tools used in operational security environments
2+ years in security operations, incident response, or IAM engineering
Analytical, troubleshooting, and communication skills
Ability to work collaboratively in a fast-paced, cross-functional environment
Proficiency in building and optimizing queries using Kusto (KQL) or experience with similar query languages for data analysis and reporting
Experience in large-scale enterprise or cloud environments
Scripting or automation experience (PowerShell, Python, etc.)