Cybersecurity Engineer

Environmental Science Associates (ESA) is a 100% employee-owned environmental consulting firm. We plan, design, permit, mitigate, and restore for projects across our communities, infrastructure systems, open spaces, and wildlands. We are 50 years strong in 21 offices across California, the Pacific Northwest, and the southeastern United States.

Environmental Science Associates (ESA) is looking for a Cybersecurity Engineer who wants to do more than monitor alerts. In this role, you will help strengthen and evolve the security program of a 100% employee-owned environmental consulting firm while protecting the systems, information, and technology our people rely on to deliver important work for clients across the country.

You will join a collaborative technology team and work across security operations, cloud and endpoint security, identity and access management, threat detection, incident response, federal cybersecurity compliance, and emerging AI security.

This role is ideal for someone with a strong foundation in Microsoft security who enjoys investigating complex problems, strengthening security controls, and developing practical solutions to emerging threats. You will have meaningful opportunities to help shape how we secure new technologies, including AI-enabled systems, as they are adopted across the firm. This is a hybrid role with working onsite a few days per week in either our Portland, OR, and/or Seattle, WA offices.

Strengthen ESA's Security Posture. Help evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and network environments. You will work extensively within ESA's Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra , and Intune.

Detect and Respond to Threats. Monitor and investigate suspicious activity using Sentinel and Defender XDR. Perform alert triage, log analysis, and threat hunting; use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry; tune detections to improve signal quality; and partner with ESA's Security Operations Center to investigate and resolve escalated incidents.

Advance Zero Trust Security. Help strengthen ESA's identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring consistent with NIST and CISA Zero Trust principles.

Support Incident Response. Help develop, test, and execute security incident response procedures and playbooks. During an incident, you will assist with investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts while coordinating with internal teams and external security partners.

Help Secure ESA's Use of AI. Work at the forefront of an evolving area of cybersecurity by helping ESA securely adopt AI systems, agents, models, MCP servers, connectors, and related technologies. You will help identify and mitigate risks including shadow AI, prompt injection, sensitive-data disclosure, excessive agent permissions, identity impersonation, poisoned data sources, compromised connectors, and insecure model outputs.

You will also help develop monitoring and incident-response approaches for AI-enabled systems and use AI-assisted security tools, including Microsoft Security Copilot, while validating AI-generated findings against authoritative source data and security telemetry.

Support NIST and CMMC Compliance. Help maintain ESA's NIST-based cybersecurity program and support environments involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). You…