Email Security SME

Role:

Email Security SME

Location:

Noida

Exp: 6y+

Role Overview

We are seeking a seasoned Email Security SME to lead the investigation and mitigation of high-criticality security threats. In this role, you will be the primary lead for responding to sophisticated email-based attacks, leveraging the full power of the Microsoft Defender XDR stack to protect our enterprise environment. You will bridge the gap between reactive incident response and proactive platform optimization.

Key Responsibilities

- Incident Leadership:
Lead investigations into high and critical severity incidents flagged by Microsoft Defender for Office 365 (MDO).
- XDR Correlation:
Correlate alerts across Defender for Endpoint, Identity, and Cloud Apps to build comprehensive incident storylines.
- Automated Response:
Execute AIR (Automated Investigation and Response) playbooks to contain threats, including soft-deleting malicious emails, removing suspicious inbox rules, and blocking malicious domains/URLs.
- Forensics & RCA:
Perform deep-dive forensic analysis on Phishing, Spoofing, and Business Email Compromise (BEC). Document detailed Root Cause Analysis (RCA) and lessons learned.
- Policy Optimization:
Provide expert recommendations for fine-tuning MDO policies (Anti-phishing, Anti-spam, Safe Links/Attachments).
- Strategic

Collaboration:

Act as the primary technical point of contact for Microsoft Premier Support and the Microsoft DART team during deep-dive investigations.
- Operational Excellence:
Maintain incident status in Service Now and identify detection gaps to improve SIEM/SOAR logic.

Required Skills & Experience

- 7+ years of dedicated experience in Email Security and Incident Response.
- Expert-level proficiency in Microsoft Defender for Office 365 (MDO).
- Proven track record of managing CSIRT bridges and coordinating with Rapid Response Teams (RRT).
- Strong understanding of the Microsoft XDR ecosystem (Endpoint, Identity, Cloud Apps).
- Ability to translate complex technical findings into clear reports for stakeholder communication.

Preferred Qualifications

- Experience contributing to SLA/KPI reporting and executive dashboards.
- Active participation in quarterly tuning sessions and security transformation workshops.
- Relevant certifications (e.g., MS-500, SC-200, or CISSP).