\"Senior Cybersecurity Engineer\"

SoCode Recruitment; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

SoCode Recruitment is seeking a Senior Cybersecurity Engineer to design, implement, and operate security controls across Microsoft 365, Azure, and endpoints in a remote US-based role. The initial focus is implementing Purview DLP, sensitivity labels, and Insider Risk Management with an external advisory partner while maintaining internal ownership.

Role expands to detection engineering, vulnerability management, cloud hardening, and privileged access management.

Qualifications

• 7+ years of cybersecurity engineering or security operations experience.
• 3+ years implementing Microsoft security tools in an enterprise.
• Proven experience with Microsoft Purview DLP and sensitivity labels.
• Knowledge of Microsoft Sentinel, KQL, and Logic Apps playbooks.
• Experience with Defender for Endpoint, Intune, and Entra ID, including CA and PIM.

Responsibilities

• Own the technical implementation of Microsoft Purview Endpoint DLP and Insider Risk Management, working with an external advisory partner.
• Lead configuration sessions, implement tenant changes directly, and take ownership of the resulting security controls.
• Deploy endpoint DLP across Windows, macOS, Edge, Chrome, and Firefox.
• Progress DLP policies through audit, warning, and blocking stages with testing and rollback procedures.
• Implement Insider Risk Management using HR data and signals with thresholds and investigation workflows.
• Expand sensitivity labels and automated labeling capabilities, integrating with DLP and Insider Risk policies.
• Configure security alerts and escalation processes with clear severity definitions and triage procedures.

Skills

Cybersecurity engineering

Security operations

KQL

PowerShell

Python

Cloud security

Education

Bachelor's degree in CS or related

Tools

Microsoft Purview DLP

Microsoft Sentinel

Microsoft Defender for Endpoint

Azure Policy

Entra ID

Job description

Senior Cybersecurity Engineer, Security Platforms

Location: Remote – United States

Travel: Up to 10%

Working Hours: North American business hours, with occasional EMEA and APAC coverage

About the Company

An established global technology and field services organization provides integrated solutions and technical services to customers across multiple industries. With a large, internationally distributed workforce, the business operates a complex technology environment spanning Microsoft 365, Azure, endpoint infrastructure, and enterprise applications.

The organization is investing in strengthening its cybersecurity capabilities, improving data protection, modernizing security operations, and reducing risk across its global IT environment.

About the Role

The Senior Cybersecurity Engineer will play a hands‑on role in designing, implementing, and operating security controls across a global Microsoft 365, Azure, and endpoint environment.

This is an individual contributor position focused on taking ownership of security initiatives from initial design and implementation through production deployment and ongoing operations. The initial priority will be leading the implementation of Microsoft Purview Data Loss Prevention (DLP), sensitivity labels, and Insider Risk Management, working alongside an external advisory partner while maintaining internal technical ownership.

Following this initial assignment, the role will expand into detection engineering, endpoint and vulnerability management, cloud security hardening, and privileged access management.

The ideal candidate is an experienced security engineer with strong hands‑on Microsoft security experience, particularly Microsoft Purview DLP and sensitivity labels. They should be comfortable making production configuration changes, collaborating with implementation partners, and translating security requirements into practical, enforceable controls.

This is a contract‑to‑hire opportunity, with the intention of transitioning successful contractors into permanent employment.

Key Responsibilities

• Own the technical implementation of Microsoft Purview Endpoint DLP and Insider Risk Management, working alongside an external advisory partner.
• Lead configuration sessions, implement tenant changes directly, and take ownership of the resulting security controls.
• Deploy endpoint DLP across Windows, macOS, Microsoft Edge, Chrome, and Firefox.
• Progress DLP policies through audit, warning, and blocking stages, with documented testing and rollback procedures.
• Implement Insider Risk Management using HR data and signals, developing appropriate thresholds and investigation workflows in collaboration with HR and Legal.
• Expand sensitivity labels and automated labeling capabilities, integrating them with DLP and Insider Risk policies.
• Configure security alerts and escalation processes with clear severity definitions and actionable triage procedures.

Detection & Incident Response

• Manage Microsoft Sentinel integrations, bringing firewall, cloud, and third‑party application logs into the SIEM.
• Develop analytics rules and automated response playbooks for key threat scenarios.
• Use KQL to investigate security events, develop detections, and improve monitoring capabilities.
• Establish measurable benchmarks for detection and incident response performance.

Endpoint & Vulnerability Management

• Develop and manage vulnerability remediation processes using scanner data, defined remediation SLAs, and emergency handling procedures for actively exploited vulnerabilities.
• Expand third‑party application patching across international environments and monitor patch compliance.
• Implement and maintain endpoint security controls, including endpoint data protection, macOS disk encryption, and macOS Local Administrator Password Solution (LAPS).
• Improve endpoint security posture through consistent configuration, monitoring, and remediation.
• Implement Azure Policy guardrails to enforce private connectivity and prevent unnecessary public exposure.
• Partner with Infrastructure teams to remediate Microsoft Defender for Cloud findings and improve alignment with CIS benchmarks.
• Support external Azure security assessments and drive remediation of identified vulnerabilities and configuration gaps.

Identity & Privileged Access Management

• Reduce unnecessary local administrator privileges through privileged access management solutions.
• Implement separate administrative accounts and strengthen privileged identity controls.
• Expand Microsoft Entra Privileged Identity Management (PIM) and improve privileged access governance.
• Strengthen Conditional Access and identity security policies across the enterprise environment.

Security Program & Collaboration

• Translate findings from external security assessments into defined improvement initiatives with clear ownership, timelines, and supporting evidence.
• Develop security standards, technical documentation, operational runbooks, and audit evidence.
• Transition completed security initiatives into ongoing operations with internal IT teams and managed detection and response partners.
• Automate repetitive security processes using scripting and other available tools.
• Test and validate security controls before and after implementation while minimizing disruption to business operations.
• Collaborate with Infrastructure, Legal, Privacy, HR, and regional IT teams across North America, EMEA, APAC, and LATAM.

Required Qualifications

• 7+ years of experience in cybersecurity engineering or security operations.
• At least 3 years of hands‑on experience implementing and managing Microsoft security tools within an enterprise tenant.
• Demonstrated production experience with Microsoft Purview DLP and sensitivity labels.
• Working knowledge of Microsoft Sentinel and KQL, including data connectors, analytics rules, and Logic Apps playbooks.
• Experience with Microsoft Defender for Endpoint, Microsoft Intune, and Microsoft Entra ID, including Conditional Access and Privileged Identity Management.
• Working knowledge of Azure security, including Defender for Cloud, Azure Policy, and network security controls.
• Experience managing vulnerability remediation programs, including prioritization, remediation SLAs, and patch compliance reporting.
• Scripting experience with PowerShell or Python.
• Bachelor's degree in Computer Science, Information Assurance, Management Information Systems, or a related discipline, or equivalent professional experience.

Preferred Qualifications

• Experience implementing Microsoft Purview Insider Risk Management.
• Familiarity with Terraform and infrastructure-as-code practices.
• Microsoft security certifications such as SC-401, SC-400, SC-200, or AZ-500.
• CISSP or GIAC certification.
• Experience working with security and compliance frameworks, including SOX ITGC, SOC 2, ISO 27001, NIST, CMMC, and CIS benchmarks.
• Takes ownership of security initiatives from design and implementation through production and ongoing operations.
• Translates business risks into practical security controls that can be effectively adopted across the organization.
• Applies an adversarial mindset to anticipate potential security weaknesses and ways controls could be bypassed.
• Communicates technical concepts clearly to different audiences, including IT teams, HR, Legal, and executive stakeholders.
• Implements changes through controlled stages, including pilot deployments, user communication, testing, and documented rollback plans.
• Works effectively with external implementation and advisory partners while maintaining internal accountability and technical ownership.
• Collaborates effectively across globally distributed teams and adapts to different regional requirements.

Success Measures

• Successful deployment of Microsoft Purview DLP enforcement and Insider Risk Management across the initial US population, with appropriately tuned alerts and established triage workflows.
• Integration of critical security log sources into Microsoft Sentinel, with 365‑day retention.
• Critical and High vulnerabilities remediated within agreed SLAs, with patch compliance progressing toward 95%.
• Reduction in Critical and High security findings across cloud and endpoint environments.
• Measurable improvements in security maturity scores following external assessments.
• Positive feedback from cross‑functional stakeholders regarding implementation quality, communication, and collaboration.

What Makes This Opportunity Interesting

• Hands‑on technical ownership: Take direct responsibility for implementing and operating enterprise security controls rather than simply advising on strategy.
• High‑impact security initiatives: Lead key improvements across data protection, insider risk, detection engineering, cloud security, and identity management.
• Microsoft security environment: Work extensively across Microsoft Purview, Sentinel, Defender, Intune, Entra ID, and Azure.
• Global exposure: Collaborate with technical and business stakeholders across multiple regions and functions.
• Long‑term opportunity: Contract‑to‑hire structure with the intention of converting successful contractors into permanent team members.
• End‑to‑end responsibility: Shape security improvements from initial implementation through operational handover and continuous improvement.