IT Security Support Engineer

Role Summary:
We are looking for an IT Security Support Engineer to join our IT Security function in a hands-on, execution-focused role supporting a lean, cloud-only, Microsoft-centric environment.
You will be the first line of defense across our endpoint protection (CrowdStrike Falcon) and email security (Proofpoint) stack, the day-to-day administrator for our Microsoft 365 and Azure environment, and a key contributor to keeping the organization continuously ready for ISO 27001:2022 surveillance and certification audits.

We expect working exposure and administrative competence across these tools with minimum of 2 years experience, not deep specialist mastery in all of them. You'll operate under the direction of the IT Security Lead, following documented runbooks and
escalation paths for anything outside routine triage, while building toward independent ownership of these systems.
Expect a mix of steady-state operations (ticket queues, access requests, alert triage) and periodic audit-cycle intensity (evidence pulls, control walkthroughs, remediation tracking).
This is a strong platform for progressing toward a specialist or architect-track security career, with direct exposure to the full breadth of a modern M365 security stack.

Key Responsibilities

• Endpoint Security (CrowdStrike Falcon): Monitor the Falcon console for detections and alerts, triage and escalate confirmed incidents, and manage sensor deployment, host groups, and policy assignment across endpoints.
  
• Email Security (Proofpoint): Administer mail filtering policies and quarantine management, investigate and remediate reported phishing/spoofing, and maintain DKIM/DMARC/SPF authentication hygiene.
  
• Microsoft 365 & Azure Administration: Own day-to-day user, license, and access administration across Exchange Online, SharePoint, Teams, Entra ID, and Intune; support Defender and Purview configurations; and maintain baseline Azure resource security hygiene (RBAC, monitoring).
  
• Compliance & ISO 27001:2022 Audit Readiness: Maintain evidence repositories for security controls, support internal and external audit cycles, and track corrective actions and non-conformities to closure.
  
• Monitoring, Incident Response & Documentation: Act as first responder for security alerts during business hours, escalate per the incident response runbook, and maintain accurate documentation of incidents, changes, and remediation steps
  
  

Requirements

Required Skills & Experience

• Minimum 2 years of hands-on experience in IT security, IT support, or systems administration, with working exposure to endpoint protection and email security tools.
  
• Practical experience administering or supporting CrowdStrike Falcon (or a comparable EDR/XDR platform).
  
• Practical experience administering or supporting Proofpoint (or a comparable secure email gateway).
  
• Working knowledge of Microsoft 365 administration: Exchange Online, SharePoint, Teams, and user/license management.
  
• Working knowledge of Azure administration fundamentals: resource groups, RBAC, basic monitoring/alerting.
  
• Familiarity with Entra ID (Azure AD) concepts — conditional access, MFA, and identity lifecycle basics.
  
• Exposure to Microsoft Defender and/or Purview (DLP, sensitivity labels) is a plus.
  
• Understanding of ISO 27001 control structure and basic audit evidence practices; direct audit participation experience is a plus.
  
• Clear, structured written communication for incident notes, tickets, and audit evidence.
  
• Manage and troubleshoot the office's core network infrastructure (Routers, Switches, Wi-Fi, firewall/VPN) to keep connectivity reliable and aligned with security policy.
  
• Ability to follow documented procedures precisely while flagging edge cases that need escalation.
  
  

Preferred Certifications

• CrowdStrike Certified Falcon Administrator (CCFA)
  
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
  
• Microsoft Certified: Azure Fundamentals (AZ-900) or Azure Administrator Associate (AZ-104)
  
• CompTIA Security+ or equivalent foundational security certification