Tier 2/3 Cyber Security Analyst / Microsoft Sentinel/Microsoft Defender

Position: Tier 2/3 Cyber Security Analyst - Microsoft Sentinel and Microsoft Defender
Program: Peraton Federal Strategic Cyber Mission

Peraton is seeking an experienced Tier 2/3 Cyber Security Analyst to join our Federal Strategic Cyber Mission program. This role requires a seasoned cybersecurity professional with extensive hands‑on experience implementing, configuring, and operating Microsoft Sentinel and Microsoft Defender security solutions. The ideal candidate will serve as a senior escalation point for complex security incidents, lead advanced threat‑hunting operations, and drive the maturation of detection capabilities across the Microsoft security ecosystem.

Key Responsibilities: 

Incident Detection, Analysis, and Response
• Detect, classify, process, track, and report cybersecurity events and incidents across the enterprise.
• Serve as senior escalation point for Tier 1 and Tier 2 triage, conducting in‑depth analysis of complex and coordinated threats in a 24x7x365 environment.
• Analyze logs from multiple sources (host, EDR, firewalls, IDS, servers) to identify, contain, and remediate suspicious activity.
• Characterize and analyze network traffic to identify anomalies and potential threats.
• Perform forensic analysis of host artifacts, network traffic, and email content.
• Analyze malicious scripts and code to mitigate threats.
• Conduct malware analysis and develop IOCs to support threat identification and mitigation.

Microsoft Sentinel & Defender Engineering and Operations
• Design, implement, configure, and maintain Microsoft Sentinel SIEM, including workspace architecture, data connectors, and log ingestion pipelines.
• Develop and tune analytics rules, scheduled queries, NRT rules, and fusion rules to optimize detection fidelity.
• Create and maintain Sentinel workbooks, hunting queries, and automation playbooks (Logic Apps).
• Implement and manage Microsoft Defender for Endpoint (MDE), including ASR rules, AIR, policy configuration, and KQL-based advanced hunting.
• Configure and operationalize Microsoft Defender for Identity, including sensor deployment, threat‑detection tuning, and lateral movement path analysis.
• Manage Microsoft Defender for Office 365, including Safe Attachments, Safe Links, anti-phishing policies, and investigation capabilities.
• Implement and maintain Microsoft Defender for Cloud for CSPM, workload protection, and cloud-native threat detection across multi-cloud environments.
• Develop custom KQL queries for hunting, detection engineering, and security analytics across M365 Defender and Sentinel.
• Integrate Sentinel with SOAR, developing automated response playbooks and orchestration workflows.
• Monitor data connector health, troubleshoot ingestion issues, and optimize log collection.
• Implement and manage Microsoft Entra ID security capabilities including Conditional Access, Identity Protection, PIM, and access reviews.

Threat Hunting & Intelligence
• Conduct proactive hunts for APTs using Sentinel and MDE hunting capabilities.
• Integrate and operationalize threat intelligence within Sentinel to enhance detection.
• Analyze threat intelligence reporting and apply adversary methodology knowledge to improve detection posture.
• Map detections and hunting hypotheses to MITRE ATT&CK and D3FEND frameworks.

Collaboration & Reporting
• Collaborate with customer teams to investigate and respond to events and incidents.
• Monitor and respond via SOAR, hotline, and designated email inboxes.
• Create tickets and initiate workflows in accordance with SOPs.
• Coordinate and report incident information to CISA as required.
• Engage with local, national, and international CIRTs as directed.
• Submit alert tuning requests and lead ongoing detection engineering efforts.
• Mentor and provide technical guidance to Tier 1 and Tier 2 analysts on Microsoft security tools and incident response processes.