Cyber Security Engineer

PowerGrid Services; Hartselle (AL); On-site; USD 90,000 - 130,000; Full time

Job summary

PowerGrid Services is seeking a cybersecurity engineer to lead vulnerability management, detection, and endpoint security across our Microsoft 365 and on-prem environments. You will run InsightVM/InsightIDR scans, manage alerts, and coordinate remediation with IT owners.

You'll administer SentinelOne, Barracuda Email Protection and related controls, develop runbooks, support audits, and participate in on-call rotation to investigate incidents and reduce risk.

Qualifications

• 3–5 years of hands-on experience in cybersecurity engineering, security operations or a closely related IT security role.
• Working experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.
• Hands-on administration of SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.
• Experience with Barracuda or another email security gateway such as Checkpoint, Proofpoint or Mimecast, plus email authentication (SPF, DKIM, DMARC).
• Strong knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune and Windows Server.
• Solid understanding of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques mapped to MITRE ATT&CK.
• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.
• Scripting ability in PowerShell; Python is a plus.

Responsibilities

• Run and tune Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.
• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.
• Validate patches and configuration fixes, and manage exceptions through a documented risk-acceptance process.
• Investigate and respond to alerts from Rapid7 InsightIDR, SentinelOne and Microsoft Defender.
• Build and tune detection rules, alert thresholds and automated response actions to reduce noise and improve fidelity.
• Lead or support incident response: scoping, containment, eradication, recovery and post-incident review.
• Perform threat hunting using endpoint telemetry, identity logs and network data.
• Administer the SentinelOne console: policies, exclusions, device groups, agent deployment and upgrade health.
• Investigate threats with SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.
• Coordinate endpoint policy with Intune and Defender to avoid gaps and conflicts.
• Administer Barracuda Email Protection: filtering policies, quarantine management, impersonation and phishing protection, and allow/block lists.
• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.
• Tune Barracuda and Microsoft 365 email controls together (SPF, DKIM, DMARC, Defender for Office 365) to cut false positives without opening gaps.
• Support security awareness efforts with phishing trends and simulation results.
• Strengthen Entra ID and Active Directory security: Conditional Access, MFA, privileged access and identity protection.
• Improve Microsoft Secure Score and apply CIS benchmarks across Windows, Microsoft 365 and Azure.
• Protect Microsoft 365 data with DLP and sensitivity labels.
• Partner with infrastructure teams on secure configuration of servers, Group Policy and cloud workloads.

Skills

Cybersecurity engineering

Security operations

Vulnerability management

EDR administration

Email security

Microsoft 365 security

Networking basics

Incident investigation

PowerShell scripting

Python

Education

Bachelor's degree in cybersecurity/computer science/IT

Tools

Rapid7 InsightVM

Rapid7 InsightIDR

SentinelOne

CrowdStrike

Defender for Endpoint

Barracuda Email Protection

Checkpoint/Proofpoint/Mimecast

Intune

Microsoft Defender for Endpoint

Job description

• Run and tune Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.
• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.
• Validate patches and configuration fixes, and manage exceptions through a documented risk-acceptance process.

What You’ll Do

Vulnerability and Exposure Management

• Run and tune Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.
• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.
• Validate patches and configuration fixes, and manage exceptions through a documented risk-acceptance process.

Detection and Response

• Investigate and respond to alerts from Rapid7 InsightIDR, SentinelOne and Microsoft Defender.
• Build and tune detection rules, alert thresholds and automated response actions to reduce noise and improve fidelity.
• Lead or support incident response: scoping, containment, eradication, recovery and post-incident review.
• Perform threat hunting using endpoint telemetry, identity logs and network data.

Endpoint Security

• Administer the SentinelOne console: policies, exclusions, device groups, agent deployment and upgrade health.
• Investigate threats with SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.
• Coordinate endpoint policy with Intune and Defender to avoid gaps and conflicts.

Email Security

• Administer Barracuda Email Protection: filtering policies, quarantine management, impersonation and phishing protection, and allow/block lists.
• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.
• Tune Barracuda and Microsoft 365 email controls together (SPF, DKIM, DMARC, Defender for Office 365) to cut false positives without opening gaps.
• Support security awareness efforts with phishing trends and simulation results.

Microsoft Environment Hardening

• Strengthen Entra ID and Active Directory security: Conditional Access, MFA, privileged access and identity protection.
• Improve Microsoft Secure Score and apply CIS benchmarks across Windows, Microsoft 365 and Azure.
• Protect Microsoft 365 data with DLP and sensitivity labels.
• Partner with infrastructure teams on secure configuration of servers, Group Policy and cloud workloads.

Program and Documentation

• Write and maintain runbooks, incident playbooks, standards and architecture documentation.
• Support audits and compliance requests with evidence collection and control testing.
• Produce metrics and clear status reports for IT leadership.
• Participate in an on-call rotation for security incidents.

What You Bring

• 3–5 years of hands-on experience in cybersecurity engineering, security operations or a closely related IT security role.
• Working experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.
• Hands-on administration of SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.
• Experience with Barracuda or another email security gateway such as Checkpoint, Proofpoint or Mimecast, plus email authentication (SPF, DKIM, DMARC).
• Strong knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune and Windows Server.
• Solid understanding of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques mapped to MITRE ATT&CK.
• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.
• Scripting ability in PowerShell; Python is a plus.
• Bachelor's degree in cybersecurity, computer science, IT or a related field, or equivalent experience.

Nice to Have

• Familiarity with NERC CIP requirements or other critical-infrastructure compliance frameworks.
• Exposure to OT/ICS environments and how securing them differs from enterprise IT.
• Familiarity with AI governance frameworks such as the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001 or the EU AI Act, and experience helping write AI acceptable-use policies.
• Understanding of AI and LLM security risks, including prompt injection, data leakage, insecure plugins and model misuse, using references such as the OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Experience securing enterprise AI tools such as Microsoft 365 Copilot, Claude Enterprise and Azure OpenAI, including data access permissions, sensitivity labels and Microsoft Purview controls for AI usage.
• Experience finding and managing unsanctioned AI apps (shadow AI) with tools such as Microsoft Defender for Cloud Apps, and assessing the security of AI vendors and AI features in third-party products.
• Experience with Microsoft Sentinel, KQL or SOAR automation.
• Knowledge of NIST CSF, NIST 800-53 or CIS Controls.
• Certifications such as Security+, CySA+, GCIH, GSEC, SC-200, AZ-500 or CISSP (or progress toward one).