Cybersecurity Engineer II

The IT Cybersecurity Engineer II position provides mid-level engineering support for the architecture, operation, automation, and continuous improvement of Orion Marine Group’s cybersecurity posture across on-premises, cloud, and hybrid environments.

Houston, TX (onsite)

• Assess Orion’s cybersecurity architecture and overall posture, identify gaps, and recommend improvements using security best practices and industry-aligned frameworks, including examples such as NIST, CIS Controls, and Zero Trust principles.
• Collaborate with IT leadership to design, evolve, and maintain layered security architecture across endpoint, network, identity, email, and cloud environments based on penetration testing, vulnerability assessments, and audit results.
• Convert penetration test and assessment findings into prioritized remediation plans and architectural changes, tracking progress through implementation and closure.
• Serve as the primary engineer for enhancement, tuning, and automation of core security platforms, including Darktrace and Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365).
• Create and maintain automation, scripts, and workflows (including examples such as Power Shell, KQL, and Logic Apps/Sentinel automation or equivalent) to streamline detection, alert triage, response actions, and reporting.
• Tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve security signal quality across platforms.
• Evaluate emerging security tools and capabilities and recommend enhancements or additions to the security tooling stack.
• Own security, access control, and configuration integrity of Orion’s SIEM and SOAR environment, ensuring detection, correlation, and automated response capabilities are hardened against unauthorized access, tampering, or misconfiguration.
• Administer role-based access, log source onboarding, and data retention in the SIEM to protect confidentiality and integrity of security event data used for detection, investigations, and audit evidence.
• Build, test, and maintain SOAR playbooks and automated response actions, applying change control and peer review to prevent unintended or unauthorized actions in production.
• Monitor SIEM/SOAR health, log ingestion completeness, and playbook execution to confirm detection and response coverage does not degrade silently.
• Own global endpoint security review, configuration, and administration across Orion locations, devices, and business units.
• Monitor endpoint security coverage, policy compliance, and protection status; identify and remediate gaps in onboarding, policy application, or protection posture.
• Manage endpoint security policies, attack surface reduction rules, device configuration baselines, and vulnerability management workflows tied to endpoint protection.
• Review and respond to endpoint-related alerts and incidents, coordinating containment, remediation, and root‑cause analysis.
• Monitor security alerts, logs, and telemetry from Darktrace, Microsoft Defender, the SIEM, and related platforms; investigate potential threats and security incidents.
• Support incident response activities, including detection, containment, eradication, and post‑incident documentation and lessons learned.
• Perform vulnerability scanning and risk assessment, coordinating remediation across infrastructure and endpoint environments.
• Support CMMC and NIST SP 800-171 compliance activities, including control implementation, evidence collection, audit support, and remediation of identified findings.
• Maintain security documentation (architecture diagrams, standard operating procedures, playbooks, and control evidence) to support auditability and…