Note: The job is a remote job and is open to candidates in USA. Teleion is a Pacific Northwest employer with a startup-oriented culture and employee-led business model. The company is seeking a Senior Cybersecurity Engineer to strengthen cloud security, lead real-world incident response, advance Microsoft security operations, implement data protection and zero trust controls, and support enterprise clients in a hands-on, client-facing role.
Responsibilities
- Configure, tune, and operate the full Microsoft security stack in production client environments: Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview
- Lead incident response for real security events — account compromise, data exfiltration, insider risk, BEC — through the full lifecycle: containment, eradication, recovery, evidence preservation, and post-incident reporting
- Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards
- Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost
- Develop SOAR playbooks to reduce false positive volume and automate analyst workflows
- Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps — driving findings to closure, not just alerting
- Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support
- Harden Azure and multi-cloud environments against benchmarks: remediate Defender for Cloud findings, drive secure score improvement, and address cloud identity and entitlement risk
- Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns
- Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation
- Design and run tabletop exercises to test and mature the client's incident response capability
Skills
- Must be living in the following states to be considered: Florida (FL), Georgia (GA) , Illinois (IL), Iowa (IA), Nevada (NV), North Carolina (NC), South Dakota (SD), Texas (TX), Washington (WA), Virginia (VA), Wisconsin (WI)
- 7 or more years of security engineering or security operations experience in enterprise environments
- Deep, production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview
- Demonstrated leadership of real security incidents — not tabletop only — through the full lifecycle including containment, eradication, recovery, and post-incident reporting
- Strong KQL proficiency: authoring analytic rules, developing hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK
- Direct, demonstrable Microsoft Purview experience: DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery
- Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk
- Experience implementing zero trust controls across multiple pillars using Conditional Access, PIM, and privileged access management
- Proficiency in PowerShell and Microsoft Graph API for security automation
- Experience coordinating with MXDR or managed SOC providers on escalation and case quality
- Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP
- Digital forensics experience in cloud and M365 environments is a plus
Benefits
- Full benefits
- PTO
- Holiday
- 401(k)
Company Overview