Sr. Cybersecurity Engineer, Detection & Response

ON.energy   is building the backbone of energy and AI infrastructure powering grid-safe data centers and mission-critical facilities. The company supplies and operates hyperscale power systems that solve the toughest resilience challenges, delivering custom solutions for AI data centers, mission-critical facilities, and front-of-the-meter assets. ON recently announced a 5GW partnership, with 3GW currently under construction across multiple hyperscale data center campuses. With patented technology and proprietary software,   ON.energy   develops projects worldwide that set new benchmarks for resilience.

ON.energy is hiring a Sr. Cybersecurity Engineer to run detection and response across the corporate security stack: the SIEM, the Defender suite, SaaS applications, and the data moving through them. A growing energy business generates significant signal across these four surfaces, and most of it currently goes unread. This is a SecOps role focused on detection ownership, response speed, and incident resolution. The underlying platforms that generate the telemetry are built and governed by other functions. This role owns turning that signal into alerts that matter and incidents that get closed.  

Key Responsibilities

Detection Engineering & Incident Response  

• SIEM (Microsoft Sentinel): Deploy and own Sentinel in the Defender portal, data connectors across Entra, Defender XDR, M365, AWS, and SaaS sources, plus the retention and tiering decisions that keep ingestion cost defensible.  


• Detection Engineering: Write and tune analytics rules and custom detections in KQL, mapped to MITRE ATT&CK. Run the tuning board; every rule requires a documented reason to exist, and noisy rules get fixed or killed.  


• Incident Response: Own the IR lifecycle end to end for anything surfaced through Sentinel: triage, containment, eradication, and written post-incident review. Maintain playbooks for top scenarios (BEC, ransomware, credential compromise, third-party breach, DLP/insider risk escalation), run tabletops with IT, Legal, and Operations leadership, and lead the corporate side of any incident that crosses into OT.  

Endpoint, Email, App & Data Security  

• Endpoint & Email (Defender): Own triage and response for Defender for Endpoint and Defender for Office 365 alerts: investigate, contain, and close the loop back into Sentinel detections. Does not own EDR policy architecture, ASR baselines, or the Intune device compliance program; that build sits with Endpoint/IT Engineering. Consumes their telemetry and detects against it.  


• App Security (Defender for Cloud Apps): Own detection logic for risky OAuth grants, shadow IT, and anomalous app behavior, fed into Sentinel as first-class detections. Does not run the SaaS app approval and governance program itself; that's a GRC/IT governance function this role feeds, not owns.  


• Data Security (Purview): Own detection and response for DLP and insider risk alerts flowing into Sentinel: investigate matches, determine real exposure, and drive the incident through to close. Does not design label taxonomy or author insider risk policy; that's a data governance function partnered with Legal and HR. Responds to what it produces.  

Governance, Risk & Compliance  

• Control Frameworks & Audit Support: Supply technical evidence and control-operation proof for SOC 2, ISO 27001, and NIST CSF 2.0 audits, and answer technical questions in customer security questionnaires, as directed by GRC. Does not own the audit relationship, the control framework, or the risk register; that sits with GRC. Proves the controls operated actually work.  

Cloud Security  

• Consume AWS GuardDuty findings into Sentinel and write detections against them. AWS security architecture and IAM least-privilege design belong to DevOps; this role owns the telemetry pipeline into the SIEM, not that surface.  

Requirements

• 5+ years of hands-on security operations and detection engineering experience, with real depth in at least two of: endpoint, email, SaaS, or data security telemetry, and hands-on ownership of incident response.  

Technical Stack Proficiency:  

• Microsoft Sentinel: Hands-on deployment, data connectors, and detections written in KQL. Comfortable tuning for signal quality and managing ingestion cost.  


• Defender suite: Working knowledge of Defender for Endpoint, Office 365, and Cloud Apps from a triage/response and detection-tuning angle, not policy architecture.  


• Purview: Experience investigating DLP and insider risk alerts and translating them into incident response, not building the DLP program.  


• Entra ID: Comfortable reading sign-in logs and Identity Protection risk signals for detection purposes, at a light touch. Deep Conditional Access/PIM architecture experience is not required.  


• Automation: KQL, PowerShell, Graph API, or Python; sufficient to automate triage rather than perform it manually.  

Required Background:

• Detection & Response Ownership: Demonstrated accountability for detection engineering and incident response outcomes across more than one telemetry source, beyond working a queue inside someone else's program.  


• Incident Response: Experience leading real incidents through post-incident review, including briefing non-technical leadership.  


• Compliance Support: Experience supplying technical evidence for a control framework audit (SOC 2, ISO 27001, NIST CSF, or similar) as the technical operator, without necessarily owning the audit relationship.  

Core Traits:  

• Hands-on: Prefers writing the KQL that proves an alert is real over describing how to write it.  


• Signal-disciplined: Every rule shipped has a documented reason to exist and gets tuned or killed when it stops earning its alert volume.  


• Evidence-disciplined: Documents while building, shaped by experience on the wrong side of an audit sample where the control worked but the proof did not exist.  


• Clear about lanes: Able to redirect an out-of-scope request to the correct owner without stalling the incident.  

Preferred:  

• Experience running SecOps in a hybrid Microsoft-and-AWS environment.  


• Background in energy, utilities, industrial, or another operationally critical sector, with enough IT/OT context to partner with an OT security engineer.  


• Certifications: SC-200 (Security Operations Analyst), CISSP, GCIH, GCIA, or GCDA.  

For US-based roles - What you’ll get:

• Competitive salary + annual performance-based bonus eligibility


• Medical, dental, and vision insurance


• 401(k) with company match


• Paid time off and company holidays 

For Mexico-based roles - What you’ll get:

• Competitive salary + annual performance bonus eligibility


• Christmas Bonus (Aguinaldo): 30 days


• Major medical expenses and life insurance


• Paid time off and holidays (per local policy)

For all roles:

• Professional development and growth opportunities


• Opportunity to grow with a mission-driven team shaping the future of clean energy


• Equal Opportunity: ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment, discrimination, or retaliation.


• Accommodations: If you need an accommodation during the application process, email View email address on jobs.jobcopilot.com


• Benefits vary by role and location and are subject to change.

Agency Notice:   ON.energy does not accept unsolicited resumes from staffing agencies, search firms, or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of ON.energy. No placement fees or compensation will be paid for unsolicited candidate submissions.