Senior Cybersecurity Engineer, Cloud & Incident Response

Salary: $176,800 - 197,600 per year Requirements: 7+ years of experience in security engineering or security operations Deep hands-on experience with Microsoft security tools, including Sentinel, Defender XDR, Defender for Cloud, Entra ID, and Intune Demonstrable Microsoft Purview experience with DLP, sensitivity labels, and Insider Risk Management Strong KQL skills, including detection development and investigative hunting Experience leading incident response for real-world incidents Azure cloud security expertise, including identity, networking, and workload protection PowerShell and Microsoft Graph API automation skills Clear written communication skills for technical and executive audiences Preferred: Experience on a lean security team spanning engineering and operations Preferred: Familiarity with Palo Alto Networks, Tanium, and CASB or SSPM platforms Preferred: Digital forensics experience, including analysis of cloud and Microsoft 365 artifacts Preferred: Experience working with an MXDR or managed SOC provider Preferred certifications: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP Responsibilities: Strengthen our cloud security posture by hardening Azure and multicloud environments against recognized benchmarks and addressing cloud security posture findings Remediate Defender for Cloud findings and improve secure scores Implement workload protection, configuration baselines, and infrastructure-as-code security checks Address cloud identity and entitlement risks, including overprivileged roles, service principals, and standing access Improve and operationalize incident response playbooks aligned with NIST SP 800-61 Lead and support investigations across cloud, identity, endpoint, email, and SaaS environments, including account compromise, data exfiltration, insider risk, and business email compromise Manage incident containment, eradication, recovery, evidence preservation, and post-incident reporting Coordinate with our managed detection and response provider on escalation quality, handoffs, and case closure Design and facilitate tabletop exercises and turn findings into control improvements Optimize Microsoft Sentinel for signal quality and cost efficiency through connector selection, ingestion tiering, and table-level retention decisions Develop and maintain KQL analytic rules and hunting queries Map detection coverage to MITRE ATT&CK and address identified gaps Reduce false positives and improve alert enrichment and automation through SOAR playbooks Design, deploy, and tune Microsoft Purview DLP policies across email, endpoints, SharePoint, OneDrive, Teams, and cloud apps Implement sensitivity labels, auto-labeling, and data classification at scale Operate Insider Risk Management and support eDiscovery and investigative requests Resolve DLP findings through policy changes, access revocation, or corrective action, rather than alerting alone Advance zero-trust maturity across identity, device, network, application, and data pillars Implement and refine conditional access, privileged identity management, device compliance, and least-privilege access models Support segmentation and egress control initiatives Technologies: API Azure Cloud Support Microsoft 365 Network PowerShell Security SharePoint Office 365 More: We are hiring for a security role focused on strengthening cloud security, improving incident response, and advancing data security and zero-trust initiatives. The position is onsite in Seattle, Washington, two to three days per week, with potential consideration for remote candidates in the Pacific Time zone. Compensation is $85–$95 per hour, depending on experience. Benefits include health and medical coverage, a 401(k), an Employee Assistance Program, and sick time where applicable by state. last updated 40 week of 2026