Microsoft Security Consultant

Opsio is a SwedishIndian managed IT services and automation company. Our customers run their businesses on Microsoft identities in Entra ID, email and collaboration in Microsoft 365, endpoints and servers protected by Defender – and they trust us to keep that estate secure, compliant and running. As Microsoft Security Consultant you become the person who owns that trust for a portfolio of customers in India and in Sweden.

This is a hands-on role with architecture-level scope. You will design and harden Microsoft 365 tenants, run Conditional Access and Zero Trust strategy in Entra ID, operate the Defender stack across endpoints, servers, identities and mail, and lead the response when something goes wrong. You will speak with Indian customers in the morning and Swedish customers in the afternoon, and you will be expected to be equally sharp in a technical deep-dive and in a board-level security review.

Identity & Access – Entra ID

• Own customer Entra ID tenants: Conditional Access design, authentication methods, MFA and passwordless rollout, Identity Protection risk policies
• Design and run Privileged Identity Management, access reviews and entitlement management so that admin rights are least-privilege and time-bound
• Manage hybrid identity (Entra Connect / Cloud Sync, password hash sync, SSO) and the application landscape – enterprise app registrations, SAML/OIDC integrations, consent governance
• Lead the Zero Trust roadmap for identity: device-based access, continuous access evaluation, guest and B2B governance, break-glass procedures

Threat Protection – Microsoft Defender

• Operate and tune Microsoft Defender XDR: Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps
• Deploy and run Defender for Servers (Defender for Cloud) across Windows and Linux workloads – on-premises, Azure and hybrid via Azure Arc – including vulnerability management, secure configuration and just-in-time access
• Build and maintain detection rules, automated investigation and response, attack surface reduction rules and device compliance baselines
• Triage and lead response on high-severity incidents, hunt threats with KQL, and feed every finding back into policy so the same attack does not work twice
• Drive Secure Score and Exposure Management improvements for each customer with measurable quarterly targets

Microsoft 365 Platform & Compliance

• Govern Exchange Online, SharePoint Online, OneDrive and Teams: security baselines, external sharing, retention and mail-flow protection (SPF, DKIM, DMARC)
• Implement Microsoft Purview for information protection – sensitivity labels, DLP and compliance policies – with GDPR, NIS2 and ISO 27001 requirements in mind for our Swedish customers and DPDP Act requirements for our Indian customers
• Administer Intune for device enrolment, configuration profiles, compliance policies and application deployment across Windows, macOS, iOS and Android
• Prepare customers for Microsoft 365 Copilot: data governance, oversharing remediation and licensing readiness

Customers, Delivery & Governance

• Run security onboardings, tenant assessments and hardening projects for new customers, and present findings and risk in plain language to IT managers and business owners
• Produce the artefacts customers and auditors expect: architecture documentation, runbooks, change records and controls evidence
• Act as escalation point for the Bangalore service desk on complex M365, identity and Defender tickets, and mentor engineers so that tier-2 work moves to the team
• Keep an eye on Microsoft licensing posture and advise customers on the right mix of Business Premium, E3/E5 and Defender add-ons

Working with AI

• Use the latest AI tools every day – for KQL hunting queries, policy reviews, incident write-ups, customer documentation and faster root-cause analysis
• Build AI-assisted security workflows for the team and share what works, so that Opsio's Microsoft practice gets sharper every month

Who we are looking for

This is not an entry-level role. We are looking for someone who has already carried the responsibility and wants a bigger stage. You have:

• 5+ years in Microsoft infrastructure or security engineering, with at least 3 years focused on Microsoft 365 and Entra ID – ideally at a managed service provider or across several tenants
• Deep, hands-on Entra ID expertise – Conditional Access, Identity Protection, PIM, access reviews, hybrid identity and app integration (SAML, OIDC, SCIM)
• Production experience with Microsoft Defender XDR and Defender for Servers – Endpoint, Office 365, Identity and Cloud – from policy design through incident response, not just the portal tour
• Strong KQL for advanced hunting and reporting, and PowerShell / Microsoft Graph for automation and tenant management
• Solid working knowledge of Intune and Microsoft Purview – device compliance, configuration, app deployment, sensitivity labels, DLP and retention
• A clear understanding of Zero Trust – and the judgement to apply it without blocking the business
• Calm under pressure – you have led an incident, you know what the first 30 minutes should look like, and you do not panic when the customer does
• A sharp eye for detail – policies named consistently, exclusions documented, changes tested in a pilot ring before they reach everyone
• Excellent written and spoken English – you will write for Swedish and Indian customers who read everything you send; Swedish is a plus, not a requirement
• Microsoft certification at expert level – SC-100 (Cybersecurity Architect) or MS-102 (Microsoft 365 Administrator) – or equivalent demonstrable experience