Microsoft Defender Support SME

Summary
 

Join a delivery team providing hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview in a large enterprise environment. This L1 role focuses on issue intake, initial triage, evidence collection, ticket updates, runbook-based support, and escalation coordination. Together we do what matters.

Key Responsibilities

• Provide L1 hypercare support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview issues raised through the agreed support process.
• Perform first-level issue intake, ticket review, basic categorization, user impact capture, and prioritization based on available evidence and support guidance.
• Collect screenshots, logs, connector status, device policy status, policy status, validation outputs, and other supporting evidence required for issue review.
• Support basic troubleshooting discussions for MDE policy deployment through Intune, MDCA connectors, data sources, policy behavior, and Purview policy behavior.
• Track hypercare issues, actions, updates, closure status, and handoffs in the agreed issue tracker or support channels.
• Coordinate escalation to L2/L3, SMEs, or client IT teams where issues require deeper investigation, advisory review, or production configuration changes.
• Maintain clear ticket notes, issue summaries, support evidence, and daily status updates aligned to agreed support windows and workstream limits.

.

Skill and experiences

• Min 4+ years’ experience in L1 support, security platform support, endpoint support, service desk coordination, or Microsoft 365 operational support.
• Working knowledge of Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview support concepts.
• Understanding of issue intake, ticket triage, evidence collection, support documentation, escalation management, and issue lifecycle tracking.
• Familiarity with MDE policy deployment via Intune, MDCA connector or policy status, and Purview IP, DLP, IRM, or DLM policy support areas.
• Ability to follow runbooks, support guides, signed-off design guidance, and agreed hypercare procedures without making unsupported production changes
• Clear communicator with strong ticket discipline, attention to evidence quality, and the ability to escalate issues promptly
• Able to work with client support teams, SOC, endpoint, Intune, identity, compliance, and operations teams
• Experience supporting regulated enterprise environments is advantageous.
• Desirable Microsoft certifications include SC-200, MD-102, SC-900, AZ-500, SC-300, SC-401.

.