Description
Due to continuing growth, we are seeking a Security Engineer focused on securing and monitoring a Microsoft 365–centric environment. This role is responsible for detecting and responding to threats across Entra ID (Azure AD), Microsoft Defender, Intune-managed endpoints, and Microsoft 365 services including Exchange Online, SharePoint, and Teams.
You will play a key role in improving visibility, strengthening access controls, and building scalable detection and response capabilities across cloud and endpoint systems.
Who we are:
Platform Accounting Group is a rapidly growing professional services firm providing tax, accounting, assurance, IT consulting, and wealth management services to small and medium sized businesses and their owners. We currently have 50+ offices across 15 states with much more growth on the horizon. Enjoy a professional and dynamic work environment while making work/life balance a priority.
What you will do:
- Monitor and investigate alerts across Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Office 365) and associated security platforms
- Analyze Entra ID (Azure AD) sign-in logs, audit logs, and risky sign-in activity to identify potential account compromise or misuse
- Respond to security incidents involving endpoints, identities, email, and collaboration platforms
- Tune and optimize detection rules, alert thresholds, and signal-to-noise ratios within SIEM and Microsoft security tools
- Perform log analysis and basic threat hunting using tools such as Microsoft Sentinel, Defender Advanced Hunting, and audit logs
- Implement and validate Conditional Access policies, MFA enforcement, and identity protection controls
- Support endpoint security through Intune and Defender for Endpoint, including policy enforcement, device compliance, and response actions
- Collaborate with IT to harden Microsoft 365 configurations (Exchange Online, SharePoint, Teams) and reduce attack surface
- Support vulnerability management by identifying gaps and coordinating remediation across systems and endpoints
- Maintain clear and audit-ready documentation of incidents, controls, and response activities
- Assist with eDiscovery, audit requests, and compliance-related investigations when required
- Identify gaps in monitoring, coverage, or controls and recommend improvements to security architecture
What we look for:
Core Knowledge & Experience
- Strong understanding of Microsoft 365 security architecture, including Entra ID, Exchange Online, SharePoint, and Teams
- Experience with Microsoft Defender security stack (Defender for Endpoint, Office 365, Identity, or Cloud Apps)
- Familiarity with identity security concepts such as MFA, Conditional Access, and identity risk
- Experience with endpoint management and security using Microsoft Intune or similar platforms
- Working knowledge of incident response processes and common attack techniques (phishing, credential abuse, lateral movement)
Technical Skills (One or More of the Following)
- Log analysis and threat hunting using Microsoft Sentinel or Defender Advanced Hunting (KQL experience preferred)
- Experience configuring and tuning alerts in SIEM, EDR, or cloud-native security tools
- Scripting or automation using PowerShell, KQL, or Python
- Experience with email security, phishing analysis, and investigation within Exchange Online
Operational & Behavioral Skills
- Ability to investigate and document security incidents with clarity and precision
- Strong communication skills with both technical and non-technical stakeholders
- Ability to collaborate across IT, infrastructure, and compliance teams
- Strong ownership mindset and ability to drive issues through resolution
- Continuous learning mindset with interest in cloud security and advanced detection
Preferred, but Not Required
- Experience with Microsoft Purview (compliance, audit, or eDiscovery)
- Familiarity with regulatory or compliance frameworks (e.g., SOC 2, GLBA, HIPAA)
- Exposure to automation, detection engineering, or security orchestration (SOAR)
- Experience supporting security operations in a cloud-first or hybrid environment
- Experience with AVD and Azure infrastructure
What we offer:
- Opportunity for advancement within a rapidly growing professional services firm
- Competitive compensation
- 401(k) and medical benefits
