Sr. Cybersecurity Engineer, Detection & Response

ON.energy • Houston, TX

2d

About The Position

ON.energy is building the backbone of energy and AI infrastructure powering grid-safe data centers and mission-critical facilities. The company supplies and operates hyperscale power systems that solve the toughest resilience challenges, delivering custom solutions for AI data centers, mission-critical facilities, and front-of-the-meter assets. ON recently announced a 5GW partnership, with 3GW currently under construction across multiple hyperscale data center campuses. With patented technology and proprietary software, ON.energy develops projects worldwide that set new benchmarks for resilience.
ON.energy is hiring a Sr. Cybersecurity Engineer to run detection and response across the corporate security stack: the SIEM, the Defender suite, SaaS applications, and the data moving through them. A growing energy business generates significant signal across these four surfaces, and most of it currently goes unread. This is a SecOps role focused on detection ownership, response speed, and incident resolution. The underlying platforms that generate the telemetry are built and governed by other functions. This role owns turning that signal into alerts that matter and incidents that get closed.

Requirements

• 5+ years of hands-on security operations and detection engineering experience, with real depth in at least two of: endpoint, email, SaaS, or data security telemetry, and hands-on ownership of incident response.
• Microsoft Sentinel: Hands-on deployment, data connectors, and detections written in KQL. Comfortable tuning for signal quality and managing ingestion cost.
• Defender suite: Working knowledge of Defender for Endpoint, Office 365, and Cloud Apps from a triage/response and detection-tuning angle, not policy architecture.
• Purview: Experience investigating DLP and insider risk alerts and translating them into incident response, not building the DLP program.
• Entra ID: Comfortable reading sign-in logs and Identity Protection risk signals for detection purposes, at a light touch. Deep Conditional Access/PIM architecture experience is not required.
• Automation: KQL, PowerShell, Graph API, or Python; sufficient to automate triage rather than perform it manually.
• Detection & Response Ownership: Demonstrated accountability for detection engineering and incident response outcomes across more than one telemetry source, beyond working a queue inside someone else's program.
• Incident Response: Experience leading real incidents through post-incident review, including briefing non-technical leadership.
• Compliance Support: Experience supplying technical evidence for a control framework audit (SOC 2, ISO 27001, NIST CSF, or similar) as the technical operator, without necessarily owning the audit relationship.
• Hands-on: Prefers writing the KQL that proves an alert is real over describing how to write it.
• Signal-disciplined: Every rule shipped has a documented reason to exist and gets tuned or killed when it stops earning its alert volume.
• Evidence-disciplined: Documents while building, shaped by experience on the wrong side of an audit sample where the control worked but the proof did not exist.
• Clear about lanes: Able to redirect an out-of-scope request to the correct owner without stalling the incident.

Nice To Haves

• Experience running SecOps in a hybrid Microsoft-and-AWS environment.
• Background in energy, utilities, industrial, or another operationally critical sector, with enough IT/OT context to partner with an OT security engineer.
• Certifications: SC-200 (Security Operations Analyst), CISSP, GCIH, GCIA, or GCDA.

Responsibilities

• Deploy and own Sentinel in the Defender portal, data connectors across Entra, Defender XDR, M365, AWS, and SaaS sources, plus the retention and tiering decisions that keep ingestion cost defensible.
• Write and tune analytics rules and custom detections in KQL, mapped to MITRE ATT&CK. Run the tuning board; every rule requires a documented reason to exist, and noisy rules get fixed or killed.
• Own the IR lifecycle end to end for anything surfaced through Sentinel: triage, containment, eradication, and written post-incident review. Maintain playbooks for top scenarios (BEC, ransomware, credential compromise, third-party breach, DLP/insider risk escalation), run tabletops with IT, Legal, and Operations leadership, and lead the corporate side of any incident that crosses into OT.
• Own triage and response for Defender for Endpoint and Defender for Office 365 alerts: investigate, contain, and close the loop back into Sentinel detections.
• Own detection logic for risky OAuth grants, shadow IT, and anomalous app behavior, fed into Sentinel as first-class detections.
• Own detection and response for DLP and insider risk alerts flowing into Sentinel: investigate matches, determine real exposure, and drive the incident through to close.
• Supply technical evidence and control-operation proof for SOC 2, ISO 27001, and NIST CSF 2.0 audits, and answer technical questions in customer security questionnaires, as directed by GRC.
• Consume AWS GuardDuty findings into Sentinel and write detections against them.

Benefits

• Competitive salary + annual performance-based bonus eligibility
• Medical, dental, and vision insurance
• 401(k) with company match
• Paid time off and company holidays
• Christmas Bonus (Aguinaldo): 30 days
• Major medical expenses and life insurance
• Paid time off and holidays (per local policy)
• Professional development and growth opportunities
• Opportunity to grow with a mission-driven team shaping the future of clean energy

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed