> Markdown version of [/jobs/ext/3003767-senior-cybersecurity-engineer](https://www.wearedevelopers.com/jobs/ext/3003767-senior-cybersecurity-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Cybersecurity Engineer - **Company:** TELEION, LLC - **Location:** Seattle, WA, United States - **Experience:** Expert - **Salary:** $155,000.0 - $200,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Microsoft Azure, Cloud Computing, Cyber Security, Data Security, Digital Forensics, Intrusion Detection and Prevention, Microsoft Security Essentials, Performance Tuning, Windows PowerShell, Kusto Query Language, Zero Trust Network Access, Microsoft SharePoint, Mitre Att&ck, Multi-Cloud, Microsoft InTune, Microsoft Sentinel, Security Orchestration, Automation & Response - **Published:** September 19, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=7ce51cdffd790ab5 ## About the Role * 7 or more years of security engineering or security operations experience in enterprise environments. * Deep, production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview. * Demonstrated leadership of real security incidents - not tabletop only - through the full lifecycle including containment, eradication, recovery, and post-incident reporting. * Strong KQL proficiency: authoring analytic rules, developing hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK. * Direct, demonstrable Microsoft Purview experience: DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery. * Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk. * Experience implementing zero trust controls across multiple pillars using Conditional Access, PIM, and privileged access management. * Proficiency in PowerShell and Microsoft Graph API for security automation. * Experience coordinating with MXDR or managed SOC providers on escalation and case quality. * Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Digital forensics experience in cloud and M365 environments is a plus. ## Description Teleion is seeking a Senior Cybersecurity Engineer to strengthen cloud security posture, mature incident response capabilities, and advance data security and zero trust for our enterprise clients. This is a hands-on, client-facing contract role spanning detection engineering, real incident ownership, Microsoft Purview and DLP, and Azure cloud hardening - all within the Microsoft security ecosystem. The ideal candidate brings deep, production-configured expertise across the full Microsoft security stack and has led real incidents from containment through post-incident reporting., * Configure, tune, and operate the full Microsoft security stack in production client environments: Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview. * Lead incident response for real security events - account compromise, data exfiltration, insider risk, BEC - through the full lifecycle: containment, eradication, recovery, evidence preservation, and post-incident reporting. * Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards. * Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost. * Develop SOAR playbooks to reduce false positive volume and automate analyst workflows. * Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps - driving findings to closure, not just alerting. * Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support. * Harden Azure and multi-cloud environments against benchmarks: remediate Defender for Cloud findings, drive secure score improvement, and address cloud identity and entitlement risk. * Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns. * Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation. * Design and run tabletop exercises to test and mature the client's incident response capability. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain) - [The Open-source Java SDK for Multi-Cloud Development - Sandeep Pal](https://www.wearedevelopers.com/videos/2113-the-open-source-java-sdk-for-multi-cloud-development-sandeep-pal) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Web-based Information Visualization](https://www.wearedevelopers.com/videos/84-web-based-information-visualization) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)