Cybersecurity Engineer

Environmental Science Associates, Inc.; Portland (OR); Hybrid; USD 110,000 - 135,000; Full time

Job summary

Environmental Science Associates (ESA) is seeking a Cybersecurity Engineer to strengthen the security program and protect systems nationwide. You will collaborate across security operations, cloud and identity management, threat detection, incident response, and federal compliance.

This hybrid role emphasizes a strong Microsoft security foundation and working in ESA’s Portland, OR and/or Seattle, WA offices, with opportunities to shape AI security and Zero Trust initiatives.

Qualifications

• Bachelor's degree in Cybersecurity, CS, or IS required.
• 3–5 years of progressively responsible cybersecurity experience.
• Experience with Microsoft Defender XDR and SIEM tools.
• Knowledge of NIST SP 800-53/800-171 and CMMC.
• Ability to communicate security risks to non-technical stakeholders.
• Willingness to respond to after-hours incidents as needed.

Responsibilities

• Strengthen ESA's security posture across endpoints, servers, cloud services, identities, and network environments.
• Detect and respond to threats using Sentinel and Defender XDR; perform alert triage and threat hunting.
• Advance Zero Trust through Conditional Access, MFA, least-privilege, device compliance, and identity monitoring.
• Support incident response procedures and playbooks; assist with investigation and containment during incidents.
• Help secure ESA's use of AI by identifying risks and validating AI security findings.
• Support NIST and CMMC compliance activities, SP 800-53 and SP 800-171 mapping, SPRS, and CUI scope.
• Improve and automate security operations with new tools and automation.
• Collaborate with IT and external partners to raise security awareness.

Skills

Cybersecurity

Security operations

Cloud security

Identity management

Threat hunting

Incident response

NIST/CMMC knowledge

AI security awareness

Communication

Problem solving

Education

Bachelor's degree in Cybersecurity / CS / IS

Tools

Microsoft Defender XDR

Defender for Endpoint

Defender for Office 365

Sentinel

Kusto Query Language (KQL)

Job description

Environmental Science Associates (ESA) is a 100% employee-owned environmental consulting firm. We plan, design, permit, mitigate, and restore for projects across our communities, infrastructure systems, open spaces, and wildlands. We are 50 years strong in 21 offices across California, the Pacific Northwest, and the southeastern United States.

Environmental Science Associates (ESA) is looking for a Cybersecurity Engineer who wants to do more than monitor alerts. In this role, you will help strengthen and evolve the security program of a 100% employee-owned environmental consulting firm while protecting the systems, information, and technology our people rely on to deliver important work for clients across the country.You will join a collaborative technology team and work across security operations, cloud and endpoint security, identity and access management, threat detection, incident response, federal cybersecurity compliance, and emerging AI security.

This role is ideal for someone with a strong foundation in Microsoft security who enjoys investigating complex problems, strengthening security controls, and developing practical solutions to emerging threats. You will have meaningful opportunities to help shape how we secure new technologies, including AI-enabled systems, as they are adopted across the firm. This is a hybrid role with working onsite a few days per week in either our Portland, OR, and/or Seattle, WA offices.

What You Will Do

Strengthen ESA's Security Posture. Help evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and network environments. You will work extensively within ESA's Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra ID, and Intune.

Detect and Respond to Threats. Monitor and investigate suspicious activity using Sentinel and Defender XDR. Perform alert triage, log analysis, and threat hunting; use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry; tune detections to improve signal quality; and partner with ESA's Security Operations Center to investigate and resolve escalated incidents.

Advance Zero Trust Security. Help strengthen ESA's identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring consistent with NIST and CISA Zero Trust principles.

Support Incident Response. Help develop, test, and execute security incident response procedures and playbooks. During an incident, you will assist with investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts while coordinating with internal teams and external security partners.

Help Secure ESA's Use of AI. Work at the forefront of an evolving area of cybersecurity by helping ESA securely adopt AI systems, agents, models, MCP servers, connectors, and related technologies. You will help identify and mitigate risks including shadow AI, prompt injection, sensitive-data disclosure, excessive agent permissions, identity impersonation, poisoned data sources, compromised connectors, and insecure model outputs.

You will also help develop monitoring and incident-response approaches for AI-enabled systems and use AI-assisted security tools, including Microsoft Security Copilot, while validating AI-generated findings against authoritative source data and security telemetry.

Support NIST and CMMC Compliance. Help maintain ESA's NIST-based cybersecurity program and support environments involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). You will contribute to NIST SP 800-53 and NIST SP 800-171 control mapping, System Security Plans, Plans of Action and Milestones, evidence collection, remediation tracking, CUI scoping, CMMC readiness, and SPRS assessment activities.

Improve and Automate Security Operations. Evaluate emerging security tools, technologies, and techniques and identify opportunities to improve detection and response through automation tools.

Collaborate and Build Security Awareness. Work closely with IT colleagues, technology leadership, employees, clients, external security providers, and auditors. Help translate complex security concepts into practical guidance and contribute to security education and awareness across ESA.

What You Will Ideally Bring

• 3–5 years of progressively responsible cybersecurity experience, including hands-on security operations or security engineering experience.
• Experience across several areas such as endpoint security, identity and access management, cloud security, network security and monitoring, vulnerability management, SIEM/log analysis, incident response, secure configuration, or security automation.
• Hands‑on experience with Microsoft Defender XDR and at least two Microsoft security technologies such as Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Entra ID, or Microsoft Intune.
• Experience with Microsoft Sentinel or a comparable SIEM, including investigating alerts, reviewing telemetry, and supporting analytics and detection rules.
• Ability to use or demonstrated ability to quickly develop proficiency in Kusto Query Language (KQL).
• Working knowledge of NIST SP 800-53, NIST SP 800-171, and CMMC within a federal contracting environment, including CUI scoping, System Security Plans, POA&Ms, and evidence collection.
• Working knowledge of security incident response, including alert triage, containment, escalation, evidence preservation, documentation, and coordination with internal and external security teams.
• Awareness of emerging AI cybersecurity risks, including shadow AI, prompt injection, sensitive-data exposure, compromised data sources and dependencies, excessive agent permissions, and identity impersonation.
• The judgment to critically evaluate AI-generated security findings and validate recommendations against source telemetry, authoritative guidance, and established security procedures.
• Ability to manage competing priorities and respond appropriately to occasional after-hours security incidents, audits, or maintenance activities.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or an equivalent combination of education, professional training, certifications, and relevant experience.

Just as important, you are curious, collaborative, and accountable. You enjoy understanding how things work, investigating what does not look right, and finding practical ways to make systems more secure. You can work independently while knowing when to escalation an issue, and you communicate technical security risks in a way that helps others make informed decisions.

Preferred Qualifications

We would be especially interested in candidates who bring one or more of the following:

• Cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GIAC, or comparable credentials.
• Microsoft certifications such as SC-200, AZ-500, or SC-300.
• Experience supporting a federal contractor or organization subject to CMMC, FAR, DFARS, NIST SP 800-171, or related federal cybersecurity requirements.
• Experience supporting a CMMC or NIST assessment, penetration test, tabletop exercise, external cybersecurity assessment, or third‑party audit.
• Experience with CUI asset inventories, data‑flow documentation, security‑control assessments, SPRS submissions, assessment evidence, or federal cyber‑incident reporting.
• Hands‑on experience with Entra Conditional Access, MFA, Privileged Identity Management, device‑compliance policies, DLP, or Microsoft Purview sensitivity labels.
• Experience with vulnerability management and security automation using technologies such as Microsoft Defender Vulnerability Management, PowerShell, or Azure Logic Apps.
• Familiarity with the NIST AI Risk Management Framework, NIST Generative AI Profile, or OWASP guidance for generative AI and LLM applications.
• Familiarity with secure software‑development practices, including threat modeling, secrets management, dependency and code scanning, API security, and CI/CD security.

Why ESA

At ESA, cybersecurity is not simply about implementing controls. We enable our employee‑owners to work confidently, protect our clients and information, meet increasingly sophisticated cybersecurity requirements, and help the firm adopt new technologies responsibly.

You’ll have the opportunity to work across traditional and emerging cybersecurity challenges, from Microsoft cloud security and threat hunting to CMMC readiness, Zero Trust, and AI security while contributing ideas that can directly influence how ESA's security program evolves.

If you are a security professional who likes to investigate, build, improve, and solve problems and you want your work to have visible impact, we'd like to hear from you.

ESA has established multiple pay ranges tailored to the economic factors in the geographies in which ESA staff reside. For this position, the range is approximately as listed based on our anticipated hiring locations as noted in the above job details. Actual compensation is determined by several factors including but not limited to an individual’s related experience, education, skills, and the city in which the applicant lives.

$110,000 - $135,000 USD

Who We Are

We are a 100% employee-owned environmental consulting firm who values diversity and inclusion and celebrate the differences that make each of us unique. Our culture is built on mutual respect, recognizing that our variety of backgrounds, experiences, and perspectives leads to better solutions, which fosters our continued success for our employee‑owners and clients.

In accordance with ESA’s duty and responsibility to provide and maintain a safe workplace that is free of known hazards and to minimize the exposure to potential hazards, any employee who works from an ESA office or conducts any other in‑person ESA work‑related activity is required to submit their proof of vaccination status or have received an approved exemption and accommodation in states which this applies.

ESA is an Equal Opportunity Employer, committed to a diverse and inclusive work environment. (EOEM/V/F/D)