Security Automation & Detection Engineer

Description MER Group is looking for a Security Engineer with a developer mindset—someone who delivers results through code and automation rather than repetitive manual work. The organization operates a full Microsoft 365 E5 environment, a SIEM and SOC, a Fortinet security fabric, and a multi-site infrastructure spanning Israel and international locations. This position comes with a genuine mandate to deliver: authority to build, a dedicated training budget, a dedicated development environment, an organization-owned code repository, and access to approved enterprise AI tools. Key Responsibilities: • Maximize the end-to-end value of the Microsoft 365 E5 security stack across identity, endpoints, cloud, and email. • Build process automations using Microsoft Graph API, Logic Apps, and scripts, including employee lifecycle management, procurement and vendor approval, and request classification and routing. • Integrate large language models (LLMs) as system components for classification, document information extraction, and summarization. • Perform detection engineering: write and tune detection rules and reduce false positives. • Build automated response playbooks using a controlled, phased approach. • Lead the consolidation of overlapping tools and reduce licensing costs. • Define security requirements for new systems and implementations, including identity, logging, permissions, and API availability. Requirements Mandatory Requirements: • Experience: 4+ years in Security Engineering or Platform Engineering. • Environment: 2+ years of hands-on experience with Microsoft 365 and Entra ID. • Development: PowerShell and Python at a tool-building level—not one-off scripting. • Integration: Experience integrating at least three systems using REST APIs and Microsoft Graph. • Automation: Experience building multi-step workflows with error handling, idempotency, and logging. • Identity and Access: Strong knowledge of RBAC, least privilege, service accounts, and secrets management. • Working Practices: Experience with Git, version control, and written technical documentation. • Languages: Hebrew and technical English. Significant Advantages: • Experience with Microsoft Defender XDR or Microsoft Sentinel, including detection-rule and playbook development. • Experience integrating LLMs into production systems—not merely using chat-based tools. • Experience implementing DLP or cloud application controls. • Background in networking and Fortinet firewalls. • Relevant certifications: SC-200, SC-300, or AZ-500.