Cyber Security Engineer

A Cyber Security Engineer at ES&S designs, implements, maintains, and improves enterprise cybersecurity technologies and controls that protect the organization's systems, networks, applications, and data. This position serves as a technical security resource supporting security monitoring, threat detection, incident response, vulnerability management, security architecture, and the development and maintenance of cybersecurity policies and standards. Ideal candidates will have 3+ years of progressive cybersecurity experience in the following areas: Azure Security Services • Hands-on experience administering and configuring Microsoft Sentinel within Microsoft Azure. • Experience creating and managing Data Collection Rules (DCRs), Log Analytics Workspaces, Azure Monitor Agent (AMA), and Logic Apps. • Experience configuring Sentinel data connectors using built-in Content Hub solutions and custom data connectors. • Knowledge of onboarding and managing Syslog, CEF, API, and custom log data sources. • Experience creating DCR transformations and custom tables to filter, parse, transform, and route security telemetry. • Knowledge of monitoring data ingestion and storage consumption, including managing data across Analytics and Data Lake tiers to optimize storage and cost. • Experience creating Sentinel Workbooks to visualize security metrics, ingestion trends, data statistics, and operational performance. • Strong working knowledge of Kusto Query Language (KQL) for data analysis, troubleshooting, reporting, and advanced threat hunting. Microsoft Defender XDR • Hands-on experience supporting and administering Microsoft Defender XDR, including incident and alert management, investigation, and response. • Experience using Advanced Hunting and KQL to investigate threats, analyze security telemetry, and identify potentially malicious activity across endpoints, identities, email, and cloud services. • Experience with Exposure Management and Vulnerability Management, including identifying, tracking, and prioritizing vulnerabilities and CVEs for remediation. • Experience onboarding Windows endpoints and servers into Microsoft Defender for Endpoint, validating sensor health, and troubleshooting onboarding and connectivity issues. • Working knowledge of Attack Surface Reduction (ASR) rules, including configuration, audit/enforcement modes, exclusions, testing, and troubleshooting. • Experience configuring and managing alert suppression and tuning to reduce false positives and improve security operations efficiency. • Experience investigating incidents and performing endpoint response and containment actions through Microsoft Defender XDR. • Preferred experience using Microsoft Sentinel with Microsoft Defender XDR's unified security operations experience, including incidents, hunting, analytics, investigation, and response across both platforms. Splunk Enterprise Cloud • Hands-on experience with Splunk Enterprise Cloud and onboarding new security and operational data sources. • Experience configuring and managing data inputs, including HTTP Event Collector (HEC). • Working knowledge of indexes, source types, data inputs, and data ingestion concepts. • Fundamental knowledge of Search Processing Language (SPL) for searching, filtering, analyzing, and reporting on data. • Experience validating and troubleshooting data ingestion, parsing, indexing, and source-type assignments. • Experience creating and scheduling Splunk searches and reports for security monitoring, operational reporting, and data analysis. Cisco XDR Security Technologies • Preferred hands-on experience with Cisco XDR, including integrating Cisco and third-party security products to ingest and correlate security telemetry. • Experience performing security investigations in Cisco XDR, including reviewing detections, investigating affected assets, and using available response actions to support threat containment and remediation. • Working knowledge of Cisco Umbrella SIG and Cisco Secure Access, including troubleshooting security policies, web access, DNS, proxy, and connectivity issues. • Understanding of SSL/TLS inspection, including certificate-based decryption, policy exclusions, certificate trust issues, and troubleshooting encrypted traffic inspection. • Understanding of Remote Browser Isolation (RBI) and how browser isolation can be used to reduce risk from potentially malicious or untrusted web content. • Experience troubleshooting security integrations and validating that telemetry from Cisco and third-party security platforms is successfully flowing into the appropriate monitoring and investigation platforms. Governance, Risk, and Compliance (GRC) • Working knowledge of information security principles, including the Confidentiality, Integrity, and Availability (CIA) triad, and the ability to apply these principles when performing security and risk assessments. • Experience performing information security assessments, identifying security gaps, documenting risks, and recommending appropriate controls and remediation activities. • Working knowledge of the NIST Cybersecurity Framework (CSF) and the ability to use NIST guidance as a reference when developing, reviewing, and maintaining information security policies and standards. • Understanding of risk management principles, including risk identification, assessment, prioritization, treatment, acceptance, and ongoing monitoring. • Knowledge of security lifecycle management, including identifying and managing risks associated with aging technologies, end-of-life systems, unsupported software, and compensating controls. • Familiarity with commonly used security frameworks and standards, including NIST CSF, NIST SP 800-series guidance, CIS Controls, and ISO/IEC 27001. • Ability to translate technical security findings into business risk, including documenting impact, likelihood, remediation recommendations, compensating controls, and residual risk. • Experience supporting risk registers, security exceptions, risk acceptance, remediation tracking, and security control assessments. Travel: Up to 10% travel is anticipated.