Key Tasks & Responsibilities:
Monitor and investigate cloud‑application‑related security alerts generated by Microsoft Defender for Cloud Apps (MDCA) under defined CSOC processes.
Perform alert triage and initial investigation to determine scope, user impact, risk level, and business relevance.
Support investigation of incidents involving risky cloud apps, OAuth abuse, data exposure, suspicious user activity, and abnormal cloud access patterns.
Assist in containment and remediation activities in coordination with Identity, Endpoint, Email, and IT platform teams.
Escalate complex or high‑risk cloud‑app security findings to L2/L3 specialists or Incident Managers with structured analysis and evidence.
Analyze user behavior, activity logs, and cloud telemetry to identify anomalies and suspicious activity.
Support policy tuning, alert refinement, and basic detection improvements to reduce false positives and improve signal quality.
Assist with shadow IT discovery, cloud app risk assessments, and enforcement of cloud app governance policies.
Support CSOC playbooks, runbooks, and response procedures related to cloud application security incidents.
Participate in post‑incident reviews and RCA discussions, contributing operational findings and improvement ideas.
Maintain accurate investigation notes, incident documentation, and response records.
Work closely with CSOC L1/L2 analysts, Identity, Endpoint, Email Security, and IT operations teams.
Support audit and compliance activities related to cloud application security controls when required.
Key Skills:
Hands‑on experience with Microsoft Defender for Cloud Apps (MDCA).
Understanding of cloud application risks, SaaS security concepts, and user activity monitoring.
Basic working knowledge of the Microsoft Defender ecosystem (MDE, MDO, Sentinel – awareness level).
Understanding of SOC operations, alert triage, investigation workflows, and escalation models.
Familiarity with incident response lifecycle and CSOC processes.
Basic experience correlating cloud‑app alerts with identity, endpoint, or email‑based signals.
Foundational knowledge of cybersecurity concepts such as access control, identity security, data protection, malware, phishing, and attack chains.
Awareness of frameworks such as MITRE ATT&CK and basic threat‑actor techniques.
Understanding of risks related to cloud usage, OAuth permissions, and SaaS data exposure.
Basic understanding of cloud identity concepts (users, roles, permissions).
Familiarity with authentication, authorization, and session‑based access risks in cloud apps.
Ability to analyze logs, user activity, and audit events for investigation purposes.
Bachelor’s degree in computer science, Information Technology, Cybersecurity, or Engineering.
2 – 4 years of cybersecurity experience, with exposure to SOC operations, cloud security, or security monitoring roles.
Hands‑on experience or operational exposure to Microsoft Defender for Cloud Apps is required.
Experience supporting low to medium‑severity cloud or SaaS security incidents in enterprise environments is preferred.
Certifications:
SC‑200: Microsoft Security Operations Analyst
