Cybersecurity Engineer

Environmental Science Associates•Portland, OR

4d•$110,000 - $135,000•Hybrid

About The Position

Environmental Science Associates (ESA) is seeking a Cybersecurity Engineer to join their collaborative technology team. This role involves strengthening and evolving the firm's security program, protecting systems, information, and technology. The engineer will work across security operations, cloud and endpoint security, identity and access management, threat detection, incident response, federal cybersecurity compliance, and emerging AI security. The position is ideal for someone with a strong Microsoft security foundation who enjoys problem-solving and developing practical solutions to emerging threats. The role offers opportunities to shape how new technologies, including AI-enabled systems, are secured as they are adopted. This is a hybrid role requiring a few days onsite per week in either Portland, OR, or Seattle, WA offices.

Requirements

3–5 years of progressively responsible cybersecurity experience, including hands-on security operations or security engineering experience.
Experience across several areas such as endpoint security, identity and access management, cloud security, network security and monitoring, vulnerability management, SIEM/log analysis, incident response, secure configuration, or security automation.
Hands-on experience with Microsoft Defender XDR and at least two Microsoft security technologies such as Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Entra ID, or Microsoft Intune.
Experience with Microsoft Sentinel or a comparable SIEM, including investigating alerts, reviewing telemetry, and supporting analytics and detection rules.
Ability to use or demonstrated ability to quickly develop proficiency in Kusto Query Language (KQL).
Working knowledge of NIST SP 800-53, NIST SP 800-171, and CMMC within a federal contracting environment, including CUI scoping, System Security Plans, POA&Ms, and evidence collection.
Working knowledge of security incident response, including alert triage, containment, escalation, evidence preservation, documentation, and coordination with internal and external security teams.
Awareness of emerging AI cybersecurity risks, including shadow AI, prompt injection, sensitive-data exposure, compromised data sources and dependencies, excessive agent permissions, and identity impersonation.
The judgment to critically evaluate AI-generated security findings and validate recommendations against source telemetry, authoritative guidance, and established security procedures.
Ability to manage competing priorities and respond appropriately to occasional after-hours security incidents, audits, or maintenance activities.
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or an equivalent combination of education, professional training, certifications, and relevant experience.
Curiosity, collaboration, and accountability.
Ability to work independently while knowing when to escalate an issue.
Ability to communicate technical security risks in a way that helps others make informed decisions.

Nice To Haves

Cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GIAC, or comparable credentials.
Microsoft certifications such as SC-200, AZ-500, or SC-300.
Experience supporting a federal contractor or organization subject to CMMC, FAR, DFARS, NIST SP 800-171, or related federal cybersecurity requirements.
Experience supporting a CMMC or NIST assessment, penetration test, tabletop exercise, external cybersecurity assessment, or third-party audit.
Experience with CUI asset inventories, data-flow documentation, security-control assessments, SPRS submissions, assessment evidence, or federal cyber-incident reporting.
Hands-on experience with Entra Conditional Access, MFA, Privileged Identity Management, device-compliance policies, DLP, or Microsoft Purview sensitivity labels.
Experience with vulnerability management and security automation using technologies such as Microsoft Defender Vulnerability Management, PowerShell, or Azure Logic Apps.
Familiarity with the NIST AI Risk Management Framework, NIST Generative AI Profile, or OWASP guidance for generative AI and LLM applications.
Familiarity with secure software-development practices, including threat modeling, secrets management, dependency and code scanning, API security, and CI/CD security.

Responsibilities

Evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and network environments, working extensively within ESA's Microsoft security ecosystem.
Monitor and investigate suspicious activity using Microsoft Sentinel and Defender XDR, perform alert triage, log analysis, and threat hunting.
Use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry and tune detections.
Partner with ESA's Security Operations Center to investigate and resolve escalated incidents.
Strengthen ESA's identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring consistent with NIST and CISA Zero Trust principles.
Develop, test, and execute security incident response procedures and playbooks, assisting with investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts during incidents.
Help ESA securely adopt AI systems, agents, models, MCP servers, connectors, and related technologies, identifying and mitigating risks such as shadow AI, prompt injection, sensitive-data disclosure, excessive agent permissions, identity impersonation, poisoned data sources, compromised connectors, and insecure model outputs.
Develop monitoring and incident-response approaches for AI-enabled systems and use AI-assisted security tools like Microsoft Security Copilot.
Maintain ESA's NIST-based cybersecurity program and support environments involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), contributing to NIST SP 800-53 and NIST SP 800-171 control mapping, System Security Plans, Plans of Action and Milestones, evidence collection, remediation tracking, CUI scoping, CMMC readiness, and SPRS assessment activities.
Evaluate emerging security tools, technologies, and techniques and identify opportunities to improve detection and response through automation.
Collaborate with IT colleagues, technology leadership, employees, clients, external security providers, and auditors.
Translate complex security concepts into practical guidance and contribute to security education and awareness across ESA.