Sr. Cybersecurity Engineer, Cloud and Incident Response

Job Description:
Location: This position requires the candidate to work onsite 2-3 days a week in Seattle, WA. Potential opening for remote candidates in PST.

This position will help strengthen the cloud security posture, mature incident response capabilities, and advance data security and zero-trust initiatives.

Responsibilities
Cloud security:
– Harden Azure and multi-cloud environments against recognized benchmarks and cloud security posture findings
– Remediate Defender for Cloud findings and drive measurable secure score improvement
– Implement workload protection, configuration baselines, and infrastructure-as-code security checks
– Address cloud identity and entitlement risk, including overprivileged roles, service principals, and standing access

Incident response:
– Enhance and operationalize incident response playbooks aligned to NIST SP 800-61
– Lead and support investigations across cloud, identity, endpoint, email, and SaaS, including account compromise, data exfiltration, insider risk, and business email compromise
– Perform containment, eradication, recovery, evidence preservation, and post-incident reporting
– Coordinate with the managed detection and response provider on escalation quality, handoff, and case closure
– Design and facilitate tabletop exercises and translate findings into control improvements

SIEM optimization and detection engineering:
– Tune Microsoft Sentinel for signal quality and cost efficiency, including connector selection, ingestion tiering, and table-level retention decisions
– Author and maintain analytic rules and hunting queries in KQL
– Map detection coverage to MITRE ATT&CK and close identified gaps
– Reduce false positive volume and improve alert enrichment and automation through SOAR playbooks

Data security and DLP:
– Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps
– Implement sensitivity labels, auto-labeling, and data classification at scale
– Operate Insider Risk Management and support eDiscovery and investigative requests
– Drive DLP findings to closure through policy change, access revocation, or corrective action, not just alerting

Zero trust:
– Advance zero trust maturity across identity, device, network, application, and data pillars
– Implement and refine conditional access, privileged identity management, device compliance, and least privilege access models
– Support segmentation and egress control initiatives

Required Qualifications
– 7+ years in security engineering or security operations
– Deep hands-on Microsoft security stack experience: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune
– Direct, demonstrable Microsoft Purview experience across DLP, sensitivity labels, and Insider Risk Management
– Strong KQL authoring ability, including detection development and investigative hunting
– Demonstrated incident response leadership on real incidents, not tabletop only
– Azure cloud security depth, including identity, networking, and workload protection
– PowerShell and Microsoft Graph API automation
– Clear written communication for both technical peers and executive audiences

Preferred
– Experience in a lean security team where the role spans engineering and operations
– Familiarity with Palo Alto Networks, Tanium, and CASB or SSPM platforms
– Digital forensics experience, including cloud and M365 artifact analysis
– Experience working alongside an MXDR or managed SOC provider
– Certifications: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, CISSP

Pay Range: $85.00 – $95.00 per hour, depending upon experience.
Health & Medical Benefits, 401K, Employee Assistance Program, and Sick Time applicable by state.