Senior Cybersecurity Engineer

Cybersecurity Jobs; Seattle (WA); On-site; USD 155,000 - 200,000; Part time

Benefits offered by this job

Full benefits

PTO

Holiday

401(k)

Job summary

Teleion Consulting is seeking a hands-on, client-facing Senior Cybersecurity Engineer to improve cloud security posture, strengthen incident response, and mature data security and zero trust across the Microsoft security ecosystem. This role requires deep production experience with Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Purview, plus the ability to lead incidents end-to-end.

You will author KQL rules, develop SOAR playbooks, and collaborate with MXDR or managed SOC

Qualifications

• 7+ years of security engineering or security operations experience in enterprise environments.

Responsibilities

• Configure, tune, and operate the Microsoft security stack in production client environments.
• Lead incident response for real security events including account compromise, data exfiltration, insider risk, and BEC.
• Coordinate with MXDR or managed SOC providers to maintain escalation quality and case closure practices.
• Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel; map detections to MITRE ATT&CK.
• Develop SOAR playbooks to reduce false positives and automate analyst workflows.
• Design and deploy Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps.
• Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
• Harden Azure and multi-cloud environments by remediating Defender for Cloud findings and improving secure score.
• Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access and PIM.
• Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.

Skills

KQL

PowerShell

Microsoft Graph API

Zero trust

Incident response

Microsoft Defender

Sentinel

Entra ID

Azure

Tools

Microsoft Sentinel

Defender XDR

Defender for Cloud

Entra ID

Intune

Microsoft Purview

SOAR

Job description

Teleion Consulting is seeking a hands-on, client-facing Senior Cybersecurity Engineer to improve cloud security posture, strengthen incident response, and mature data security and zero trust across the Microsoft security ecosystem.

Responsibilities

• Configure, tune, and operate the Microsoft security stack in production client environments, including Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
• Lead incident response for real security events, including account compromise, data exfiltration, insider risk, and BEC, covering containment, eradication, recovery, evidence preservation, and post-incident reporting.
• Coordinate with MXDR or managed SOC providers to maintain escalation quality, handoff standards, and case closure practices.
• Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel; map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost.
• Develop SOAR playbooks to reduce false positives and automate analyst workflows.
• Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps, driving findings to closure.
• Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
• Harden Azure and multi-cloud environments by remediating Defender for Cloud findings, improving secure score, and addressing cloud identity and entitlement risk.
• Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns.
• Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.
• Design and run tabletop exercises to test and mature the client incident response capability.

Requirements

• 7+ years of security engineering or security operations experience in enterprise environments.
• Deep, production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
• Demonstrated leadership handling real security incidents through the full lifecycle, including containment, eradication, recovery, and post-incident reporting.
• Strong KQL proficiency: analytic rule creation, hunting query development, tuning for cost and signal quality, and mapping to MITRE ATT&CK.
• Direct, demonstrable Microsoft Purview experience covering DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery.
• Experience hardening Azure environments by remediating Defender for Cloud findings, improving secure score, and addressing cloud identity and entitlement risk.
• Experience implementing zero trust controls across multiple pillars using Conditional Access and PIM and privileged access management.
• PowerShell and Microsoft Graph API proficiency for security automation.
• Experience coordinating with MXDR or managed SOC providers on escalation and case quality.
• Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Digital forensics experience in cloud and M365 environments is a plus.

Technologies

• Microsoft Sentinel
• Defender XDR
• Defender for Cloud
• Entra ID
• Intune
• Microsoft Purview
• KQL
• MITRE ATT&CK
• SOAR
• Microsoft Graph API
• PowerShell
• Conditional Access
• PIM
• Insider Risk Management
• eDiscovery
• DLP
• SharePoint
• OneDrive
• Teams
• Azure
• Microsoft security ecosystem
• MXDR
• Managed SOC providers
• Sensitivity labels
• Device compliance
• Least-privilege access patterns
• Tabletop exercises

Job Details

• Location: Seattle, WA (onsite)
• Compensation: USD 155,000 - 200,000 per year
• Employment type: contract

Benefits

• Full benefits
• PTO
• Holiday
• 401(k)