Bachelor's degree in Cybersecurity, IT, Computer Science, Engineering, or equivalent experience.
4+ years in cybersecurity, security operations, incident response, or related fields.
Hands-on experience with security event investigations and impact assessments.
Familiarity with SIEM platforms like Microsoft Sentinel or similar technologies.
Experience with security telemetry from endpoints, identity, cloud, email, or networks.
Knowledge of Microsoft security technologies such as Microsoft Defender and Microsoft Entra ID.
Experience in developing or tuning alerts and detection logic.
Understanding of common attacker techniques like credential abuse and lateral movement.
Responsibilities
Monitor and investigate security activities across various telemetry sources.
Develop, test, and document security detections and alerting logic.
Conduct threat hunting to identify monitoring gaps and enhance visibility.
Investigate incidents involving identity compromise, malware, and unauthorized access.
Establish scope and impact of security incidents and coordinate remediation efforts.
Preserve evidence and document findings during investigations.
Engage stakeholders and provide technical evidence for security decisions.
Benefits
Medical, dental, and vision insurance
401(k) with company match
Paid time off
Health Savings Account (HSA) with company contribution
Flexible Spending Accounts (FSA)
Company-paid life and AD&D insurance
Short- and long-term disability coverage
Tuition reimbursement
Full Job Description
As a Security Operations Engineer, you will help protect the organization's systems, identities, data, and operations through security monitoring, threat detection, investigation, and incident response activities. Working across a multi-site environment, you will partner with internal teams and external security providers to improve visibility, strengthen detection capabilities, support timely response efforts, and continuously enhance the organization's cybersecurity posture.
Responsibilities
Monitors and investigates security activity across security information and event management (SIEM), endpoint, identity, email, cloud, network, and other security telemetry sources.
Develops, tests, tunes, and documents security detections, analytics, alerting logic, and monitoring capabilities.
Conducts threat hunting activities, identifies monitoring gaps, and improves visibility across critical environments.
Investigates identity compromise, malware, phishing, endpoint compromise, unauthorized access, suspicious cloud activity, and other cybersecurity events.
Establishes the scope, impact, affected assets, identities, users, data, and required containment actions for security incidents.
Coordinates containment and remediation activities with technology teams, system owners, application owners, and external service providers.
Preserves technical evidence, documents investigation findings, validates remediation activities, and escalates significant cybersecurity exposures when appropriate.
Engages business and technical stakeholders during investigations and provides technical evidence to support operational, legal, contractual, compliance, and security decisions.
Collaborates with external Security Operations Center (SOC) and Managed Security Service Provider (MSSP) partners to improve investigation quality, escalation effectiveness, and response outcomes.
Supports security metrics, continuous improvement initiatives, and technical evidence requirements associated with cybersecurity, customer, and internal security obligations.
Required Qualifications
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
Four or more years of experience in cybersecurity, security operations, incident response, detection engineering, security engineering, threat hunting, or a related discipline.
Hands-on experience investigating security events and determining scope and impact.
Experience with security information and event management (SIEM) or security monitoring platforms such as Microsoft Sentinel or similar technologies.
Experience working with endpoint, identity, cloud, email, or network security telemetry.
Familiarity with Microsoft Defender, Microsoft Entra ID, or related Microsoft security technologies.
Experience developing or tuning alerts, analytics, queries, or detection logic.
Working knowledge of common attacker techniques, including credential abuse, privilege escalation, persistence, and lateral movement.
Strong analytical, communication, and documentation skills.
Preferred Qualifications
Experience in aerospace, defense, manufacturing, federal contracting, or another regulated environment.
Experience with Microsoft 365 Government Community Cloud High (GCC High) or government cloud environments.
Familiarity with Cybersecurity Maturity Model Certification (CMMC), National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171), Defense Federal Acquisition Regulation Supplement (DFARS), Controlled Unclassified Information (CUI), or the National Institute of Standards and Technology Cybersecurity Framework.
Experience with Kusto Query Language (KQL), MITRE ATT&CK, threat hunting, or managed Security Operations Center (SOC) and Managed Security Service Provider (MSSP) environments.
Experience supporting significant cybersecurity incidents or ransomware investigations.
Relevant security certifications.
This position requires U.S. person status under U.S. export control laws, including U.S. citizens and nationals, lawful permanent residents, refugees, and asylees.
Benefits
Medical, dental, and vision insurance
401(k) with company match
Paid time off
Health Savings Account (HSA) with company contribution
