Cybersecurity Engineer

Environmental Science Associates seeks a Cybersecurity Engineer to strengthen and evolve its security program using Microsoft security tools while protecting systems and data in a hybrid environment.

Responsibilities

• Evaluate, configure, and continuously improve security across endpoints, servers, cloud, identities, and network environments.
• Operate extensively within the ESA Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra ID, and Intune.
• Monitor and investigate suspicious activity using Sentinel and Defender XDR.
• Perform alert triage, log analysis, and threat hunting; investigate telemetry using Kusto Query Language (KQL) and Advanced Hunting.
• Tune detections to improve signal quality and partner with ESA’s Security Operations Center to investigate and resolve escalated incidents.
• Strengthen identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring aligned with NIST and CISA Zero Trust principles.
• Develop, test, and execute security incident response procedures and playbooks.
• Support incident activities including investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts, coordinating with internal teams and external security partners.
• Help securely adopt AI systems and related technologies (agents, models, MCP servers, connectors) as ESA’s cybersecurity needs evolve.
• Identify and mitigate AI-related and application risks such as shadow AI, prompt injection, sensitive-data disclosure, excessive agent permissions, identity impersonation, poisoned data sources, compromised connectors, and insecure model outputs.
• Build monitoring and incident-response approaches for AI-enabled systems, using AI-assisted security tools such as Microsoft Security Copilot; validate AI-generated findings against authoritative source data and security telemetry.
• Maintain ESA’s NIST-based cybersecurity program and support environments involving FCI and CUI.
• Support control mapping and assessment work tied to NIST SP 800-53 and NIST SP 800-171, including System Security Plans, Plans of Action and Milestones, evidence collection, remediation tracking, CUI scoping, CMMC readiness, and SPRS assessment activities.
• Evaluate emerging security tools, technologies, and techniques; identify automation opportunities to improve detection and response.
• Collaborate with IT colleagues, technology leadership, employees, clients, external security providers, and auditors.
• Translate complex security concepts into practical guidance and contribute to security education and awareness across ESA.

Requirements

• 3–5 years of progressively responsible cybersecurity experience, including hands-on security operations or security engineering.
• Experience across multiple areas such as endpoint security, identity and access management, cloud security, network security and monitoring, vulnerability management, SIEM/log analysis, incident response, secure configuration, or security automation.
• Hands-on experience with Microsoft Defender XDR and at least two Microsoft security technologies from: Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Entra ID, or Microsoft Intune.
• Experience with Microsoft Sentinel or a comparable SIEM, including investigating alerts, reviewing telemetry, and supporting analytics and detection rules.
• Ability to use, or demonstrated ability to quickly develop proficiency in, Kusto Query Language (KQL).
• Working knowledge of NIST SP 800-53, NIST SP 800-171, and CMMC in a federal contracting environment, including CUI scoping, System Security Plans, POA&Ms, and evidence collection.
• Working knowledge of security incident response, including alert triage, containment, escalation, evidence preservation, documentation, and coordination with internal and external teams.
• Awareness of emerging AI cybersecurity risks, including shadow AI, prompt injection, sensitive-data exposure, compromised data sources and dependencies, excessive agent permissions, and identity impersonation.
• Judgment to critically evaluate AI-generated security findings and validate recommendations against source telemetry, authoritative guidance, and established security procedures.
• Ability to manage competing priorities and respond appropriately to occasional after-hours security incidents, audits, or maintenance activities.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or an equivalent combination of education, professional training, certifications, and relevant experience.

Technologies

• Microsoft Sentinel; Defender XDR; Defender for Endpoint; Defender for Office 365; Defender for Identity; Defender for Cloud; Entra ID; Intune
• Kusto Query Language (KQL); Advanced Hunting; Conditional Access; multifactor authentication
• NIST; CISA Zero Trust; NIST SP 800-53; NIST SP 800-171; CMMC; SPRS
• Microsoft Security Copilot; MCP servers; PowerShell; Azure Logic Apps
• Microsoft Defender Vulnerability Management; Microsoft Purview sensitivity labels
• OWASP guidance for generative AI and LLM applications; NIST AI Risk Management Framework; NIST Generative AI Profile
• FAR; DFARS; CUI; FCI

Preferred Qualifications

• Cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GIAC, or comparable credentials.
• Microsoft certifications such as SC-200, AZ-500, or SC-300.
• Experience supporting a federal contractor or organization subject to CMMC, FAR, DFARS, NIST SP 800-171, or related federal cybersecurity requirements.
• Experience supporting a CMMC or NIST assessment, penetration test, tabletop exercise, external cybersecurity assessment, or third-party audit.
• Experience with CUI asset inventories, data-flow documentation, security-control assessments, SPRS submissions, assessment evidence, or federal cyber-incident reporting.
• Hands-on experience with Entra Conditional Access, MFA, Privileged Identity Management, device-compliance policies, DLP, or Microsoft Purview sensitivity labels.
• Experience with vulnerability management and security automation using Microsoft Defender Vulnerability Management, PowerShell, or Azure Logic Apps.
• Familiarity with the NIST AI Risk Management Framework, NIST Generative AI Profile, or OWASP guidance for generative AI and LLM applications.
• Familiarity with secure software-development practices, including threat modeling, secrets management, dependency and code scanning, API security, and CI/CD security.

Hybrid Work Requirement

• Hybrid role with working onsite a few days per week in either the Portland, OR and/or Seattle, WA offices.

Salary

• $110,000 - $135,000 per year

Location

• Bend, OR (hybrid)

Application Notes

• Non-acceptance of unsolicited resumes: ESA does not accept unsolicited resumes from agencies.
• Reasonable accommodation: Applicants who require accommodation to complete the application process or cannot use the online system may contact Human Resources at [email protected].