Cybersecurity Engineer II

The IT Cybersecurity Engineer II provides mid-level engineering support for the architecture, operation, automation, and continuous improvement of Orion's cybersecurity posture across on-premises, cloud, and hybrid environments. This role is responsible for evaluating and strengthening the overall security architecture, and for enhancing and automating existing security tooling to improve detection, response, and operational efficiency. The role also owns the security and integrity of Orion's SIEM and SOAR environment, ensuring the platforms that detect and respond to threats are themselves properly access-controlled, hardened, and monitored.

The position holds global ownership of endpoint security review and administration, ensuring consistent policy enforcement, coverage, and hardening across the environment.

While the primary focus of this role is cybersecurity engineering, the Cybersecurity Engineer II is expected to be well-rounded across core infrastructure disciplines. The role actively cross-trains and provides backup support with the Infrastructure team and participates in shared operational and on-call responsibilities. This role works under the direction of IT leadership while partnering with the Infrastructure team, Service Desk, Applications, and business stakeholders to maintain a secure, resilient, and well-documented technology environment.

This role supports cybersecurity technologies and services including endpoint detection and response (EDR/XDR), network detection and response (NDR), SIEM and SOAR platforms, identity security, email security, vulnerability management, security monitoring and alerting, and security automation, in addition to cross-functional support of virtualization, backup, and related on-premises infrastructure.

The incumbent must support Orion's guiding beliefs and core values centered on Safety
, Quality
, Delivery
, and Teamwork
, and most importantly, built upon the all-important foundation of Integrity
.

• Evaluate Orion's overall cybersecurity architecture and posture, identifying gaps and recommending improvements aligned with security best practices and industry frameworks (for example, NIST, CIS Controls, Zero Trust principles).
• Partner with IT leadership to design and evolve a layered security architecture across endpoint, network, identity, email, and cloud environments, informed by findings from penetration tests, vulnerability assessments, and audits.
• Translate penetration test and assessment findings into prioritized remediation plans and architectural changes, tracking implementation through to closure.

• Serve as the primary engineer responsible for enhancing, tuning, and automating Orion's core security platforms, including Darktrace and Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365).
• Develop and maintain automation, scripts, and workflows (for example, Power Shell, KQL, Logic Apps/Sentinel automation, or equivalent) to streamline detection, alert triage, response actions, and reporting, reducing manual security operations effort.
• Continuously tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve signal quality across security platforms.
• Evaluate emerging security tools and capabilities and recommend enhancements or additions to the security tooling stack.

• Own the security, access control, and configuration integrity of Orion's SIEM and SOAR environment, ensuring the platforms responsible for detection, correlation, and automated response are themselves hardened against unauthorized access,…