Role Responsibilities / Accountabilities

Microsoft Estate Assessment, Gap Analysis & Strategy

• Conduct a structured, critical assessment of the current Microsoft security estate, covering Active Directory, Microsoft Entra ID, Intune, M365 (E3 and current Defender deployments), and Azure security configuration; benchmark the current state against Microsoft’s secure score recommendations, vendor best practice, and the Group cyber technical standard, and produce a clear, evidence-based gap analysis.
• Develop a prioritised Microsoft security uplift strategy and delivery plan that sequences remediation and enhancement activity by risk reduction impact, operational feasibility, and alignment with the E5 migration roadmap; ensure the plan is realistic for federated environment and has clear milestones, owners, and success criteria.
• Maintain the Microsoft security uplift plan as a live document; track progress against milestones, report status to the Security Platform Engineering Manager, and adapt the plan to the Groups environment, the threat landscape, and the Microsoft product roadmap evolve.

Microsoft Defender Platform Ownership & Engineering

• Own the technical configuration, ongoing engineering, and operational health of the full M365 Defender suite, including Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, and Microsoft Sentinel integration; maintain configurations to the approved baseline and drive continuous improvement against vendor-recommended configuration.
• Work closely with the SOC to tune Defender configurations for effective detection and response; adjust detection rules, custom detection queries, and alert thresholds in response to SOC operational feedback, ensuring analysts receive high-fidelity, actionable alerts with minimal noise.
• Develop and maintain detailed configuration documentation, runbooks, and change records for all Defender workloads; ensure configuration state is consistently documented, version-controlled, and auditable.

Entra ID Security & Identity Controls

• Own the security configuration of Microsoft Entra ID across the Group; take implied technical ownership of the security-relevant Entra capabilities including Conditional Access policy design and enforcement, Privileged Identity Management (PIM), access packages and entitlement management, Identity Protection, and the application of least privilege principles across the directory.
• Work with the Cyber Architecture Manager, the IT Frameworks Director, and Assurance leads to ensure that GCS policies – including BYOD, remote access, and privilege management policies – are correctly and completely manifested in Entra Conditional Access policies and Intune device compliance rules; maintain a clear mapping between policy intent and platform configuration.
• Support the Active Directory to Entra ID modernisation journey; identify legacy AD configurations and hybrid identity risks that need to be addressed as part of the E5 migration, and work with the Identity Transformation team to ensure Entra security configuration activity is co-ordinated with the broader identity programme.
• Own the Intune security configuration, maintain device compliance policies, configuration profiles, and security baselines; ensure Intune is configured to enforce the Group endpoint security standard and provides accurate device compliance data to Entra Conditional Access and the Defender estate.

E5 Migration, ECIF Engagement & Microsoft Relationship

• Act as GCS’s primary technical liaison to the Microsoft ECIF (Engineering Co-Investment Fund) team; plan, prioritise, and drive the E5 deployment programme in partnership with the ECIF team, ensuring that Microsoft engineering resources are directed at the highest-value activities and that the Organisation is getting the maximum benefit from the co-investment engagement.
• Manage the technical relationship with Microsoft across the security and identity platform; maintain active engagement with Microsoft technical account management, product specialists, and engineering teams; use the account relationship to gain early access to roadmap briefings, preview features, escalation paths, and best-practice guidance relevant to the organisations environment.
• Plan and manage the technical delivery of E5 capability rollout across the divisions; sequence deployment activity to maximise early security value, sequence it safely within the change management constraints, and ensure each phase is fully tested, documented, and supported before moving to the next.
• Maintain accurate records of Microsoft licence entitlements, feature adoption, and E5 deployment progress; ensure the Group is consuming the capabilities it is paying for, and provide the Security Platform Engineering Manager with clear, up-to-date visibility of licence utilisation and deployment status.

Policy Manifestation, Standards Alignment & Assurance

• Translate Group cyber technical standards and security policies into enforceable Microsoft platform configurations; maintain a clear, auditable mapping between each policy requirement and its implementation in Defender, Entra, Intune, or other Microsoft controls, and ensure divergence is identified and remediated promptly.
• Work closely with the Director of Cyber Assurance and Assurance leads to support controls assessment of the Microsoft estate; provide technical evidence of configuration compliance, investigate gaps identified through continuous controls monitoring (including Axonius), and drive remediation of control failures to closure.
• Work with the Cyber Architecture Manager to ensure that Microsoft security configurations are consistent with the Group cyber enterprise architecture and approved reference patterns; flag and resolve any divergence between the configured state and the architectural design intent.

Divisional Engagement, Change Communication & End-User Focus

• Work directly with Divisional Security Leads to share emerging practice, gather direct and usable feedback on how Microsoft security configurations are landing in the business, and drive adoption of a consistent, vendor-recommended Microsoft configuration across all 11 divisions as quickly as the operating model allows.
• Put end users at the heart of every configuration and deployment decision; maintain a zero-tolerance approach to avoidable downtime, design changes to minimise disruption to business operations, and ensure that user-impacting changes are thoroughly tested and piloted before broad rollout.
• Own the change communication approach for Microsoft platform changes; ensure that divisions, IT teams, and end users understand what is changing, why it is changing, and what they need to do – well in advance of any change taking effect; develop training and guidance materials that help users and IT teams adapt confidently to new security controls.
• Provide technical configuration guidance and support to divisional IT and security teams deploying or operating Microsoft security platforms in their environments; act as the technical authority for Microsoft platform queries across the Group, and help divisional teams reach and maintain compliance with the Group Microsoft security baseline.

Identity Transformation Alignment & Stakeholder Collaboration

• Work closely and continuously with the Identity Transformation team throughout the transformation programme; ensure that GCS Microsoft security configuration activity – particularly Entra ID, PIM, and Conditional Access – is