Lead identity and Microsoft 365 security monitoring, investigation, and incident response, including identity compromise, suspicious authentication activity, phishing, token/session abuse, business email compromise, unauthorized cloud access, and potential data exfiltration across Exchange Online, SharePoint, OneDrive, Teams, and connected services. The engineer will lead complex identity and cloud-security investigations, develop and tune detection and response capabilities, strengthen privileged-access and managed-device controls, and help prevent unauthorized access and data exfiltration from Exchange Online, SharePoint, OneDrive, Teams, and other enterprise services.