Your day at NTT DATA

Reporting to the Practice Lead – End User Services, the Security Engineer supports security operations and modern workplace security across Microsoft 365, Mimecast, and endpoint environments.

The role focuses on incident response, security control management, and continuous improvement across identity, endpoint, and email platforms, bridging operational security with engineering enhancements.

Key Roles and Responsibilities

• Investigate and respond to security incidents across Microsoft 365, endpoint, and email environments by analysing alerts from tools such as Sentinel and Defender, performing root cause analysis, and supporting remediation.
• Administer and enhance Microsoft 365 security controls, including Entra ID, Conditional Access, Defender, and endpoint security (Intune), while supporting Zero Trust initiatives and policy enforcement.
• Support secure configurations and contribute to M365 migrations and improvements, ensuring alignment with best practices for identity, device, and data protection.
• Improve and maintain SIEM detection capabilities by supporting use case tuning, identifying gaps, and assisting with basic threat detection and hunting.
• Develop and support automation and operational efficiencies using scripting to streamline incident response, monitoring, and reporting.
• Contribute to security dashboards and reporting, providing visibility across identity, endpoint, and email security.
• Collaborate with L3 engineers and cross-functional teams on incident escalation, security improvements, and documentation of standard practices.

Skills & Attributes

• Strong analytical and incident investigation skills
• Good understanding of modern workplace security concepts (Zero Trust)
• Ability to balance operations and improvement work
• Comfortable working across identity, endpoint, and email domains
• Strong communication and stakeholder engagement skills
• Self-driven with ability to identify improvement opportunities
• Understanding of security operations processes and service delivery (SLAs, incident handling, escalation models)

Required Experience

• Strong analytical and security incident investigation skills
• Good understanding of modern workplace security concepts, including Zero Trust
• Working knowledge of identity, endpoint, and email security domains
• Ability to balance operational tasks and continuous improvement initiatives
• Familiarity with security operations processes (incident handling, escalation, SLAs)
• Basic scripting capability (e.g., PowerShell, KQL, or Python) is an advantage
• Strong communication and documentation skills, with ability to engage stakeholders
• Self-motivated with a proactive approach to identifying and driving improvements
• Ability to work independently and collaboratively in a fast-paced environment

Qualifications

• Bachelor’s degree in IT, Computer Science, or related field

Preferred Certifications

• SC-200, SC-300, SC-400
• AZ-500 (Azure Security)
• Microsoft 365 Administration certifications