Security Engineer

• Investigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths
• Analyze endpoint, identity, email, cloud, network, and application telemetry to validate activity, determine scope, and document findings
• Develop, test, deploy, tune, and document detections across SIEM, XDR, EDR, cloud, identity, email, and other telemetry
• Develop approved enrichment, triage, notification, containment, and remediation workflows for Tier 1 scenarios
• Perform scoped threat hunts and retrospective searches using documented hypotheses and established analysis methods
• Support telemetry onboarding, platform configuration, integrations, and troubleshooting
• Maintain case records, detection documentation, automation runbooks, and technical procedures
• Contribute to project milestones and escalate work beyond established authority, procedures, or technical scope
• Monitor and investigate security events from SaaS applications, PaaS platforms, APIs, web applications, and database services
• Develop application-layer threat detections, enrichment logic, and response workflows
• Support Sentinel, Defender XDR, SOAR, telemetry connectors, case management, and related integrations
• Coordinate routine technical work with internal teams and service providers

• General knowledge of security operations, incident response, detection engineering, and common attacker techniques
• Hands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies
• Experience using KQL, SPL, SQL, or a comparable query language
• Foundational experience with PowerShell, Python, APIs, or comparable automation technologies
• Ability to document technical findings clearly and exercise sound escalation judgment
• Experience investigating endpoint, identity, email, cloud, network, or application security activity and preserving clear evidence of analysis
• Working understanding of incident classification, escalation, containment, remediation, and recovery practices
• Ability to use established engineering standards, peer review, source control, testing, and controlled deployment processes
• Ability to balance concurrent incidents and engineering work, communicate status, and request guidance when scope or authority is exceeded
• Bachelor + 2 years; Master + 0 years; PhD + 0 years; or equivalent
• Relevant equivalent knowledge or work experience may be considered in accordance with the FA Technical Leveling definitions
• Preferred: Hands-on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365
• Preferred: Experience working with an outsourced SOC, MDR, MSSP, or managed threat hunting provider
• Preferred: Experience creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics
• Preferred: Relevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent

• Equal opportunity employer committed to a workplace and recruitment process free from unlawful discrimination, harassment, and retaliation
• No recruitment fees charged to candidates