Cybersecurity Engineer

Environmental Science Associates is strengthening and evolving its cybersecurity program with a Microsoft security stack, combining real-world threat detection with Zero Trust practices and AI-aware security. This hybrid role in Bend, OR (with onsite days in Portland, OR and/or Seattle, WA) focuses on protecting systems and data while helping the organization maintain NIST-based controls in a federal contracting environment.

• Evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and networks
  .
• Work extensively in ESA’s Microsoft security ecosystem
  , including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra , and Intune.
• Monitor and investigate suspicious activity using Sentinel and Defender XDR
  , performing alert triage, log analysis, and threat hunting.
• Use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry, tune detections for improved signal quality, and partner with ESA’s Security Operations Center on escalated incidents.
• Strengthen identity and device security using Conditional Access
  , multi‑factor authentication
  , least‑privilege access, device compliance, and identity monitoring aligned with NIST and CISA Zero Trust principles.
• Develop, test, and execute security incident response procedures and playbooks, supporting investigation, containment, evidence preservation, escalation, endpoint isolation, and disabling compromised accounts as needed.
• Support secure adoption of AI systems, agents, models, MCP servers, connectors, and related technologies
  , focusing on emerging AI cybersecurity risks such as shadow AI, prompt injection, and sensitive‑data disclosure.
• Develop monitoring and incident‑response approaches for AI‑enabled systems and use AI‑assisted security tools
  , including Microsoft Security Copilot
  , while validating AI‑generated findings against authoritative source data and security telemetry.
• Maintain ESA’s NIST‑based cybersecurity program for environments involving FCI and CUI
  .
• Support control mapping and assessment activities, including NIST SP 800‑53 and NIST SP 800‑171 mapping, System Security Plans, POA&Ms, evidence collection and remediation tracking, CUI scoping, CMMC readiness, and SPRS assessment activities.
• Evaluate emerging tools and automation opportunities that improve detection and response, and translate complex security topics into practical guidance for internal education and awareness.

• 3–5 years of progressively responsible cybersecurity experience, including hands‑on security operations or security engineering.
• Experience across areas such as endpoint security, identity and access management, cloud security, network security and monitoring, vulnerability management, SIEM/log analysis, incident response, secure configuration, or security automation.
• Hands‑on experience with Microsoft Defender XDR and at least two Microsoft security technologies such as Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Entra , or Microsoft Intune.
• Experience with Microsoft Sentinel (or comparable SIEM), including alert investigation, telemetry review, and support for analytics and detection rules.
• Ability to use Kusto Query Language (KQL) or quickly develop proficiency.
• Working knowledge of NIST SP 800‑53
  , NIST SP 800‑171
  , and CMMC within a federal contracting environment, including CUI scoping, System Security Plans, POA&Ms, and evidence collection.
• Working knowledge of security incident response, including alert triage, containment, escalation, evidence preservation, documentation, and coordination with internal and external teams.
• A…