Sr. Cybersecurity Engineer, Cloud and Incident Response

Location: This position requires the candidate to work onsite 2-3 days a week in Seattle, WA. Potential opening for remote candidates in PST.

This position will help strengthen the cloud security posture, mature incident response capabilities, and advance data security and zero-trust initiatives.

Responsibilities Cloud security:

• Harden Azure and multi-cloud environments against recognized benchmarks and cloud security posture findings
• Remediate Defender for Cloud findings and drive measurable secure score improvement
• Implement workload protection, configuration baselines, and infrastructure-as-code security checks
• Address cloud identity and entitlement risk, including overprivileged roles, service principals, and standing access

Incident response:

• Enhance and operationalize incident response playbooks aligned to NIST SP 800-61
• Lead and support investigations across cloud, identity, endpoint, email, and SaaS, including account compromise, data exfiltration, insider risk, and business email compromise
• Perform containment, eradication, recovery, evidence preservation, and post-incident reporting
• Coordinate with the managed detection and response provider on escalation quality, handoff, and case closure
• Design and facilitate tabletop exercises and translate findings into control improvements

SIEM optimization and detection engineering:

• Tune Microsoft Sentinel for signal quality and cost efficiency, including connector selection, ingestion tiering, and table-level retention decisions
• Author and maintain analytic rules and hunting queries in KQL
• Map detection coverage to MITRE ATT&CK and close identified gaps
• Reduce false positive volume and improve alert enrichment and automation through SOAR playbooks

Data security and DLP:

• Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps
• Implement sensitivity labels, auto-labeling, and data classification at scale
• Operate Insider Risk Management and support eDiscovery and investigative requests
• Drive DLP findings to closure through policy change, access revocation, or corrective action, not just alerting

Zero trust:

• Advance zero trust maturity across identity, device, network, application, and data pillars
• Implement and refine conditional access, privileged identity management, device compliance, and least privilege access models
• Support segmentation and egress control initiatives

7+ years in security engineering or security operations

• Deep hands-on Microsoft security stack experience: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune
• Direct, demonstrable Microsoft Purview experience across DLP, sensitivity labels, and Insider Risk Management
• Strong KQL authoring ability, including detection development and investigative hunting
• Demonstrated incident response leadership on real incidents, not tabletop only
• Azure cloud security depth, including identity, networking, and workload protection
• PowerShell and Microsoft Graph API automation
• Clear written communication for both technical peers and executive audiences

Preferred

• Experience in a lean security team where the role spans engineering and operations
• Familiarity with Palo Alto Networks, Tanium, and CASB or SSPM platforms
• Digital forensics experience, including cloud and M365 artifact analysis
• Experience working alongside an MXDR or managed SOC provider
• Certifications: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, CISSP