Security Automation & Detection Engineer

Description

MER Group is looking for a Security Engineer with a developer mindset— someone who delivers results through code and automation rather than repetitive manual work. The organization operates a full Microsoft 365 E5 environment, a SIEM and SOC, a Fortinet security fabric, and a multi-site infrastructure spanning Israel and international locations. This position comes with a genuine mandate to deliver: authority to build, a dedicated training budget, a dedicated development environment, an organization-owned code repository, and access to approved enterprise AI tools.

Key Responsibilities

• Maximize the end-to-end value of the Microsoft 365 E5 security stack across identity, endpoints, cloud, and email.
• Build process automations using Microsoft Graph API, Logic Apps, and scripts, including employee lifecycle management, procurement and vendor approval, and request classification and routing.
• Integrate large language models (LLMs) as system components for classification, document information extraction, and summarization.
• Perform detection engineering: write and tune detection rules and reduce false positives.
• Build automated response playbooks using a controlled, phased approach.
• Lead the consolidation of overlapping tools and reduce licensing costs.
• Define security requirements for new systems and implementations, including identity, logging, permissions, and API availability.

Requirements

Mandatory Requirements

Experience: 4+ years in Security Engineering or Platform Engineering. Environment: 2+ years of hands-on experience with Microsoft 365 and Entra ID. Development: PowerShell and Python at a tool-building level—not one-off scripting. Integration: Experience integrating at least three systems using REST APIs and Microsoft Graph. Automation: Experience building multi-step workflows with error handling, idempotency, and logging. Identity and Access: Strong knowledge of RBAC, least privilege, service accounts, and secrets management. Working Practices: Experience with Git, version control, and written technical documentation. Languages: Hebrew and technical English.

Significant Advantages

Experience with Microsoft Defender XDR or Microsoft Sentinel, including detection-rule and playbook development. Experience integrating LLMs into production systems—not merely using chat-based tools. Experience implementing DLP or cloud application controls. Background in networking and Fortinet firewalls. Relevant certifications: SC-200, SC-300, or AZ-500.