Cybersecurity Engineer (Support Services)

Tech One Global Lanka Pvt Ltd. is seeking a Cybersecurity Engineer to join our Microsoft Security practice as a technical support specialist. This role is responsible for the triage, investigation, and resolution of Microsoft security support services across a managed customer portfolio, spanning Sentinel, Defender XDR, Entra ID, and baseline Azure and M365 security configurations. Operating at L1 and L2 tiers, you will manage incidents within defined SLAs, engage directly with customer security contacts, and escalate effectively to senior engineers. This role includes participation in an on-call roster and extended hours schedule on a rotational basis.

• Ticket Triage & SLA Management: Demonstrate technical maturity in assessing issue severity, scope, and customer impact accurately from the outset, ensuring tickets are correctly prioritized, ownership is established, and SLA milestones are actively tracked from first response through to closure. Escalate L3 issues with clear, well-documented diagnostic findings for efficient senior engineer handover.
• Microsoft Sentinel Support: Monitor and investigate Sentinel workspaces for active incidents, false positives, and data ingestion issues. Perform KQL-based log investigation to triage alerts and identify root cause. Escalate analytics rule tuning, playbook faults, and connector issues to senior engineers with complete diagnostic context.
• Defender XDR Alert Investigation: Investigate alerts across MDE, MDO, and MDI through the unified XDR portal. Perform device, user, and email-based triage, execute basic containment actions where authorized, and produce clear incident summaries and root cause findings for customer communication.
• Entra ID & Identity Support: Diagnose and resolve Conditional Access failures, MFA/SSPR problems, PIM issues, SSO/federation errors, Identity Protection risk events, and Entra Connect sync failures. Escalate complex hybrid identity and advanced risk policy issues with sufficient diagnostic context.
• Broader Security Stack Troubleshooting: Diagnose and resolve support issues across the Microsoft security stack, spanning Defender for Cloud alerts, Security Copilot, Azure Policy compliance issues, RBAC and Key Vault access problems, Intune compliance failures, and M365 baseline security misconfigurations — accounting for hybrid and co-managed endpoint scenarios where cloud and on-premises controls intersect.
• Customer Communication & Reporting: Maintain clear, timely communication with customer contacts, providing status updates, plain-language resolution summaries, and root cause findings. Contribute to monthly security support reporting and participate in service review meetings as required.
• Knowledge Base & Operational Coverage: Document resolution procedures and recurring issue patterns to improve L1 capability and reduce repeat escalations. Participate in an on-call roster and extended hours schedule on a rotational basis to maintain continuous customer SLA coverage.