Senior Cybersecurity Engineer - Cloud & Incident Response

Job Description

PLEASE NOTE: ONLY SEATTLE-BASED CANDIDATES SHOULD APPLY

\n

\n

Company Description Plaster Group, LLC is an AI-native solutions consulting firm that helps large enterprises drive transformation through AI, intelligent automation, and enterprise software delivery. The firm serves Fortune 500 and multi-billion-dollar organizations across more than 13 industries, including aerospace, technology, healthcare, retail, energy, and financial services. Plaster Group embeds AI into every engagement to accelerate outcomes, reduce costs, and build enduring competitive advantage. With seven integrated practice areas—AI Business Transformation, AI Governance, Business Operations, Data & Analytics, Enterprise Software, Information Security, and Program & Project Management—the company delivers secure, cloud-deployed, enterprise-grade solutions using the latest AI technologies. Plaster Group is model-agnostic and platform-independent, selecting the best tools for each client environment, whether from Anthropic, OpenAI, Google, Microsoft, Recursive, etc.

\n

\n

Role Description The Senior Cybersecurity Engineer - Cloud & Incident Response is a full-time, on-site role based in Seattle, WA. This role is responsible for designing, implementing, and maintaining secure cloud architectures and controls across multiple platforms to protect enterprise applications and data. Primary responsibilities will include the following:

\n

\n

Cloud Security:

\n

•   Harden Azure and multi-cloud environments against recognized benchmarks and cloud security posture findings

\n

•   Remediate Defender for Cloud findings and drive measurable secure score improvement

\n

•   Implement workload protection, configuration baselines, and infrastructure-as-code security checks

\n

•   Address cloud identity and entitlement risk, including overprivileged roles, service principals, and standing access

\n

\n

Incident Report:

\n

•   Enhance and operationalize incident response playbooks aligned to NIST SP 800-61

\n

•   Lead and support investigations across cloud, identity, endpoint, email, and SaaS, including account compromise, data exfiltration, insider risk, and business email compromise

\n

•   Perform containment, eradication, recovery, evidence preservation, and post-incident reporting

\n

•   Coordinate with the managed detection and response provider on escalation quality, handoff, and case closure

\n

•   Design and facilitate tabletop exercises and translate findings into control improvements

\n

\n

SIEM Optimization and Detection Engineering:

\n

•   Tune Microsoft Sentinel for signal quality and cost efficiency, including connector selection, ingestion tiering, and table-level retention decisions

\n

•   Author and maintain analytic rules and hunting queries in KQL

\n

•   Map detection coverage to MITRE ATT&CK and close identified gaps

\n

•   Reduce false positive volume and improve alert enrichment and automation through SOAR playbooks

\n

\n

Data Security & DLP:

\n

•   Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps

\n

•   Implement sensitivity labels, auto-labeling, and data classification at scale

\n

•   Operate Insider Risk Management and support eDiscovery and investigative requests

\n

•   Drive DLP findings to closure through policy change, access revocation, or corrective action, not just alerting

\n

\n

Zero Trust:

\n

•   Advance zero trust maturity across identity, device, network, application, and data pillars

\n

•   Implement and refine conditional access, privileged identity management, device compliance, and least privilege access models

\n

•   Support segmentation and egress control initiatives

\n

\n

Required Qualifications

\n

•   7+ years in security engineering or security operations

\n

•   Deep hands-on Microsoft security stack experience: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune

\n

•   Direct, demonstrable Microsoft Purview experience across DLP, sensitivity labels, and Insider Risk Management

\n

•   Strong KQL authoring ability, including detection development and investigative hunting

\n

•   Demonstrated incident response leadership on real incidents, not tabletop only

\n

•   Azure cloud security depth, including identity, networking, and workload protection

\n

•   PowerShell and Microsoft Graph API automation

\n

•   Clear written communication for both technical peers and executive audiences

\n

\n

Preferred Qualifications

\n

•   Experience in a lean security team where the role spans engineering and operations

\n

•   Familiarity with Palo Alto Networks, Tanium, and CASB or SSPM platforms

\n

•   Digital forensics experience, including cloud and M365 artifact analysis

\n

•   Experience working alongside an MXDR or managed SOC provider

\n

•    Certifications: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, CISSP

\n