Senior SecOps: Detection & Incident Response Engineer

ON.energy; Houston (TX); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with company match

Paid time off and holidays

Job summary

ON.energy in Houston seeks a Sr. Cybersecurity Engineer to own detection and response across the SIEM, Defender suite, SaaS applications, and data movements. You will translate telemetry into actionable alerts and drive incident resolution in a fast-paced SecOps environment.

You will tune detections, write KQL rules, and support audits (SOC 2, ISO 27001, NIST CSF) while collaborating with IT, Legal, and Operations. Hybrid MS/AWS experience and energy infrastructure familiarity are preferred.

Qualifications

• 5+ years of hands-on security operations and detection engineering experience, with depth in at least two telemetry sources (endpoint, email, SaaS, or data security).
• Experience owning incident response lifecycle end-to-end and ability to lead post-incident reviews.
• Experience supporting technical audits (SOC 2, ISO 27001, NIST CSF, or similar) as the technical operator.

Responsibilities

• Detection Engineering & Incident Response: deploy and own Sentinel, write detections, and manage IR lifecycle.
• Endpoint, Email, App & Data Security: triage and respond to Defender alerts; manage detections in Sentinel.
• Data Security: own DLP and insider risk detections flowing into Sentinel; investigate matches and drive closure.
• Control Frameworks & Audit Support: provide technical evidence for audits and answer security questions for customers.
• Consume AWS GuardDuty findings into Sentinel and write detections against them.

Skills

KQL

PowerShell

Graph API

Python

Microsoft Sentinel

Defender suite

Purview

Entra ID

Tools

Microsoft Sentinel

Defender for Endpoint

Defender for O365

Defender for Cloud Apps

Purview

Entra ID

Job description

ON.energy in Houston seeks a Sr. Cybersecurity Engineer to own detection and response across the SIEM, Defender suite, SaaS applications, and data movements. You will translate telemetry into actionable alerts and drive incident resolution in a fast-paced SecOps environment.

You will tune detections, write KQL rules, and support audits (SOC 2, ISO 27001, NIST CSF) while collaborating with IT, Legal, and Operations. Hybrid MS/AWS experience and energy infrastructure familiarity are preferred.