Microsoft Cloud Security Engineer

Chevo LLC•Washington, DC

1d•$145,000 - $170,000

About The Position

Chevo LLC is seeking a Microsoft Cloud Security Engineer to serve as Key Personnel on the DOI Office of Wildland Fire (OWF) FireNet Enterprise Business Services contract. FireNet is a Microsoft 365/Azure-based interagency collaboration platform supporting federal, state, tribal, and local wildland fire operations across DOI, USDA Forest Service, and non-federal partners. This role is essentially an O365 security engineer with experience with Entra ID and Azure system management. The chosen candidate will oversee the hands-on security engineering for the FireNet tenant and is expected to implement all recommendations in the necessary administration portals, including Microsoft Entra, Azure Portal, Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Exchange Online, Intune, and the Microsoft 365 Admin Center.

Requirements

Bachelor’s degree in computer science, Information Security, Information Technology, or a related field preferred.
Additional years of directly relevant experience may substitute for degree requirements consistent with the Contractor's MAS pricelist.
Demonstrated, hands-on engineering enterprise Microsoft 365 and Azure security environments, including deep proficiency with Entra ID/Azure Active Directory, Conditional Access, PIM, MFA, and zero-trust architecture principles.
Experience with Microsoft Defender for Cloud, Microsoft Sentinel, and KQL for custom analytics rules and threat hunting is required.
Familiarity with Microsoft Purview and data governance control within a government environment.
Must be able to obtain and maintain a Federal Public Trust (NACI).
Must be comfortable serving in an on-call capacity during national wildland fire preparedness seasons (National Preparedness Level 3–5).

Nice To Haves

Demonstrated experience with Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Intune, and endpoint security management is strongly preferred.
Experience operating in DOI, FISMA, FedRAMP, or NIST 800-53 compliance environments is strongly preferred.
Familiarity with DOI or other Federal agency security operations and authorization-to-operate (ATO/A&A) documentation is a plus.
Experience developing administrative and security automation using PowerShell, Microsoft Graph API, Azure CLI, Logic Apps, or similar technologies is desirable.
Relevant Microsoft certifications such as SC-100 (Cybersecurity Architect), SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator), or AZ-500 (Azure Security Engineer) are highly desirable and may substitute for certain experience requirements consistent with the GSA MAS pricelist.

Responsibilities

Engineer, implement, and continuously improve the security posture of the FireNet Microsoft 365 and Azure environment.
Configure and maintain Entra ID Conditional Access policies, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) to enforce a zero-trust, least-privilege posture across all privileged and high-risk roles.
Manage guest and external identity lifecycle including entitlement management, access packages, and periodic access reviews in coordination with Government ISSOs and program stakeholders.
Oversee Microsoft Secure Score and Identity Secure Score improvements, developing and executing a monthly action plan to achieve net-positive score improvements and remediating critical findings within 10 business days or an approved POA&M.
Build, administer, and maintain Microsoft Defender for Cloud (including anti-phishing, anti-malware, Safe Links, Safe Attachments, and attack surface reduction controls) and Microsoft Sentinel analytics rules, incident playbooks, KQL workbooks, and queries to detect and respond to threats across the tenant.
Support Purview data loss prevention and sensitivity label implementation as authorized by the Government and ensure all logging and telemetry pipelines are configured for continuous monitoring IAW the DOI Continuous Monitoring Plan and FISMA requirements.
Conduct threat hunting, vulnerability management, security assessments, and remediation activities using Microsoft security platforms and industry best practices.
Provide on-call coverage for Priority 1 security and platform incidents, with expectations to acknowledge within 30 minutes, begin triage within 1 hour, and restore or implement a workaround within 4 hours.
Lead technical incident response activities including investigation, containment, eradication, recovery, and post-incident reporting in coordination with IT Project Manager and Government stakeholders.
Prepare CAB packets for security-scoped changes, coordinate with the Power Platform Lead and Web Development team on security controls and DevOps pipeline guardrails, and contribute to monthly Security Posture Reports and knowledge transfer documentation for Government ISSOs.
Review and provide security architecture recommendations for new Azure, Microsoft 365, Power Platform, automation, and application integration initiatives to ensure alignment with Zero Trust and Federal security requirements.
Develop and maintain security automation solutions using PowerShell, Microsoft Graph, Azure CLI, Logic Apps, or other approved tools to improve operational efficiency and consistency.