Senior Cybersecurity Engineer, Cloud & Incident Response

Salary: $176,800 - 197,600 per year Requirements:

• 7+ years of experience in security engineering or security operations
• Deep hands-on experience with Microsoft security tools, including Sentinel, Defender XDR, Defender for Cloud, Entra ID, and Intune
• Demonstrable Microsoft Purview experience with DLP, sensitivity labels, and Insider Risk Management
• Strong KQL skills, including detection development and investigative hunting
• Experience leading incident response for real-world incidents
• Azure cloud security expertise, including identity, networking, and workload protection
• PowerShell and Microsoft Graph API automation skills
• Clear written communication skills for technical and executive audiences
• Preferred: Experience on a lean security team spanning engineering and operations
• Preferred: Familiarity with Palo Alto Networks, Tanium, and CASB or SSPM platforms
• Preferred: Digital forensics experience, including analysis of cloud and Microsoft 365 artifacts
• Preferred: Experience working with an MXDR or managed SOC provider
• Preferred certifications: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP

• Strengthen our cloud security posture by hardening Azure and multicloud environments against recognized benchmarks and addressing cloud security posture findings
• Remediate Defender for Cloud findings and improve secure scores
• Implement workload protection, configuration baselines, and infrastructure-as-code security checks
• Address cloud identity and entitlement risks, including overprivileged roles, service principals, and standing access
• Improve and operationalize incident response playbooks aligned with NIST SP 800-61
• Lead and support investigations across cloud, identity, endpoint, email, and SaaS environments, including account compromise, data exfiltration, insider risk, and business email compromise
• Manage incident containment, eradication, recovery, evidence preservation, and post-incident reporting
• Coordinate with our managed detection and response provider on escalation quality, handoffs, and case closure
• Design and facilitate tabletop exercises and turn findings into control improvements
• Optimize Microsoft Sentinel for signal quality and cost efficiency through connector selection, ingestion tiering, and table-level retention decisions
• Develop and maintain KQL analytic rules and hunting queries
• Map detection coverage to MITRE ATT&CK and address identified gaps
• Reduce false positives and improve alert enrichment and automation through SOAR playbooks
• Design, deploy, and tune Microsoft Purview DLP policies across email, endpoints, SharePoint, OneDrive, Teams, and cloud apps
• Implement sensitivity labels, auto-labeling, and data classification at scale
• Operate Insider Risk Management and support eDiscovery and investigative requests
• Resolve DLP findings through policy changes, access revocation, or corrective action, rather than alerting alone
• Advance zero-trust maturity across identity, device, network, application, and data pillars
• Implement and refine conditional access, privileged identity management, device compliance, and least-privilege access models
• Support segmentation and egress control initiatives

• API
• Azure
• Cloud
• Support
• Microsoft 365
• Network
• PowerShell
• Security
• SharePoint
• Office 365

More:

We are hiring for a security role focused on strengthening cloud security, improving incident response, and advancing data security and zero-trust initiatives. The position is onsite in Seattle, Washington, two to three days per week, with potential consideration for remote candidates in the Pacific Time zone. Compensation is $85–$95 per hour, depending on experience. Benefits include health and medical coverage, a 401(k), an Employee Assistance Program, and sick time where applicable by state.

last updated 40 week of 2026