Security Detections

Security Detections Engineer Jobs

2 jobs found

2d ago

Senior Cybersecurity Engineer

Teleion Consulting Seattle, WA

Seattle, WA

2d ago

$155k - $200k/yr Contract Senior Azure Ad / Entra Id Cloud Platforms

Apply Now

Job Description

Teleion Consulting is hiring a hands-on, client-facing Senior Cybersecurity Engineer to help strengthen cloud security posture and operational readiness for real-world threats. This onsite contract role in Seattle, WA focuses on maturing incident response, advancing data protection, and improving zero trust capabilities across the Microsoft security ecosystem, including Sentinel, Defender, Entra, Intune, and Microsoft Purview.

You will directly support production client environments by configuring and operating Microsoft security tools, leading incident response activities end-to-end, and building durable detection and automation workflows that reduce noise and improve analyst efficiency. The role also includes improving security hygiene in Azure and multi-cloud settings through benchmark remediation and identity and entitlement risk reduction.

Responsibilities

Configure, tune, and operate the Microsoft security stack in production client environments, including Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Lead incident response for real security events such as account compromise, data exfiltration, insider risk, and BEC, covering containment, eradication, recovery, evidence preservation, and post-incident reporting.
Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards.
Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost.
Develop SOAR playbooks to reduce false positive volume and automate analyst workflows.
Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps, moving findings to closure rather than alerting only.
Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
Harden Azure and multi-cloud environments by remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns.
Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.
Design and run tabletop exercises to test and mature the client’s incident response capability.

Requirements

7+ years of security engineering or security operations experience in enterprise environments.
Production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Demonstrated leadership of real security incidents through the full lifecycle, including containment, eradication, recovery, and post-incident reporting.
Strong KQL proficiency, including analytic rules, hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK.
Direct, demonstrable Microsoft Purview experience across DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery.
Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Experience implementing zero trust controls across multiple pillars using Conditional Access and PIM (privileged access management).
PowerShell and Microsoft Graph API proficiency for security automation.
Experience coordinating with MXDR or managed SOC providers on escalation and case quality.
Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Cloud and M365 digital forensics experience is a plus.

Benefits

Full benefits
PTO
Holiday
401(k)

Salary: USD 155,000 - 200,000 per year. Location: Seattle, WA (onsite). Job type: contract.

View full job page →

20d ago

Security Engineer

Neptune Technology Group Inc. Duluth, GA

Duluth, GA

20d ago

Full time Cloud Platforms Data Loss Prevention Edr And Xdr

Apply Now

Job Description

The Security Engineer will operate within Neptune Technology Group Inc.’s Security Operations Center (SOC), where the role designs, implements, administers, and optimizes cybersecurity technologies. This position also provides technical leadership for incident detection, investigation, response, and remediation while driving continuous improvements through engineering and process enhancements.

Onsite Location

Duluth, GA (onsite)
Duluth, GA, Tallassee, AL

Role Responsibilities

Design, configure, implement, and maintain security platforms including SIEM, EDR/XDR, SOAR, Identity and Access Management (IAM), Data Loss Prevention (DLP), Vulnerability Management, and Cloud Security solutions
Evaluate, test, and deploy new security technologies, including Proof of Concept (POC) evaluations
Develop automation and orchestration workflows to improve operational efficiency
Support cloud security and Zero Trust initiatives across the enterprise
Develop and tune security detections, correlation rules, and dashboards to improve threat detection while reducing false positives
Conduct proactive threat hunting and analyze security telemetry across endpoints, network, identity, cloud, and SIEM platforms
Identify opportunities to strengthen detection and response capabilities across the environment
Monitor emerging threats, vulnerabilities, and industry best practices to inform detection strategy
Provide technical leadership during complex and escalated incident activities, including investigation, containment, eradication, and recovery
Investigate advanced cyber threats and complex security alerts
Collect and analyze forensic artifacts, logs, and endpoint telemetry during investigations
Participate in an on-call rotation and provide advanced technical support during critical incidents
Support root cause analysis and post-incident reviews
Validate vulnerability findings and coordinate remediation activities with IT Operations, Infrastructure, and Engineering teams
Implement security controls to address identified risks and track remediation efforts within the vulnerability management program
Partner with SOC Analysts, IT Operations, Infrastructure, Cloud, and Engineering teams to implement and maintain security solutions
Develop response playbooks, engineering standards, and operational procedures
Mentor SOC Analysts through technical guidance and support
Create and maintain technical documentation supporting SOC operations
Collaborate with Neptune’s MSSP and third-party security partners on engineering and investigation initiatives
Support compliance initiatives aligned with NIST CSF, CIS Controls, ISO 27001, and Roper Cybersecurity requirements
Recommend improvements to strengthen Neptune’s security posture, resilience, and compliance
Assist with audit requests, evidence collection, and security documentation

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience)
2–5 years of experience in cybersecurity, security operations, incident response, or a related technical field
Experience investigating security alerts, detections, and cybersecurity incidents
Experience working in a Security Operations Center (SOC) environment
Experience with SIEM and EDR platforms
Understanding of security engineering concepts, including detection engineering, automation, and security tool administration
Strong analytical, troubleshooting, and problem-solving skills
Strong written and verbal communication skills

Relevant Technologies

SIEM
EDR/XDR
SOAR
Identity and Access Management (IAM)
Data Loss Prevention (DLP)
Vulnerability Management
Cloud Security solutions
CrowdStrike Falcon
Google SecOps (Chronicle)
Microsoft Defender
Microsoft Entra ID (IAM)
Cloud Security Platforms (AWS, Azure)
MITRE ATT&CK Framework
PowerShell
Python
NIST CSF
CIS Controls
ISO 27001
Roper Cybersecurity requirements

Expected Platform Experience

CrowdStrike Falcon
Google SecOps (Chronicle)
Microsoft Defender
SIEM Platforms
Endpoint Detection and Response (EDR) Platforms
Security Orchestration, Automation, and Response (SOAR)
Identity and Access Management (IAM) / Microsoft Entra ID
Data Loss Prevention (DLP)
Cloud Security Platforms (AWS, Azure)
Vulnerability Management Platforms

Preferred Qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or related field
2–5 years of experience in Security Operations, Cybersecurity, Incident Response, Vulnerability Management, or Information Technology
Experience with SIEM platforms such as Google SecOps, Chronicle, Splunk, QRadar, Microsoft Sentinel, or similar technologies
Experience with EDR platforms such as CrowdStrike Falcon or Microsoft Defender
Familiarity with the MITRE ATT&CK Framework, threat hunting, and threat intelligence methodologies
Experience supporting vulnerability management programs and remediation activities
Knowledge of Windows, Active Directory, Microsoft Entra ID, networking fundamentals, and cloud security concepts
Experience working with AWS and/or Azure environments
Familiarity with NIST Cybersecurity Framework, CIS Controls, ISO 27001, and security best practices
Experience with scripting or automation using PowerShell, Python, or similar languages

Certifications (Preferred)

Security+
CySA+
GSEC
GCIH
GCIA
GCED
CISSP (Associate or Full)
SC-200
SC-100
CrowdStrike Certifications
Google SecOps Certifications
AWS or Azure Security Certifications

Education

Bachelor’s Degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related field preferred
Equivalent military, technical, or professional experience will be considered

Travel Requirements

Typically requires overnight travel less than 10% of the time

Experience Level

Minimum experience: 2 years
Years of experience (IT, Security & Compliance): 2–5 years

View full job page →

Security Detections Engineer Jobs

Senior Cybersecurity Engineer

Security Engineer

Get Security Detections Engineer Jobs alerts