Note: The job is a remote job and is open to candidates in USA. Dice is hiring a Senior Security Engineer / Architect to serve as the principal technical authority for information security and the CISO's primary technical partner. The role owns security architecture, detection engineering, threat hunting, incident response, identity and data protection, technology evaluation, and technical mentorship across the security function.
Responsibilities
- Provide architectural oversight across the security stack, ensuring identity, endpoint, network, data, and cloud controls are designed and implemented coherently and in line with best practices
- Own the design, deployment, and continuous improvement of security controls across Microsoft Entra ID, Conditional Access, Azure, and the broader Microsoft Defender suite (Endpoint, Identity, Cloud, Cloud Apps), driving full utilization of licensed protections and staying current with Microsoft's evolving security platform
- Serve as the CISO's primary technical advisor on security design, investment, and risk decisions; partner on business case development and contribute to executive presentation of major initiatives
- Lead technical evaluation of security technologies across the full ecosystem: conduct structured proof-of-concept assessments, evaluate competing platforms and tools against current deployments, identify capability gaps and overlaps, and develop defensible recommendations that inform technology investment and architecture decisions
- Maintain working knowledge of the broader security tool landscape beyond the current stack, including competing identity providers, SIEM platforms, endpoint detection solutions, and cloud security posture management tools, in order to benchmark current capabilities and surface alternatives when the environment warrants
- Partner with infrastructure, identity, and application teams to embed security into every project lifecycle, leading design reviews, threat modeling, and risk-based recommendations
- Own the detection engineering lifecycle in the enterprise SIEM platform: develop, tune, and retire analytics rules; build and refine workbooks; curate connectors and data sources for high-fidelity visibility
- Design and implement User and Entity Behavior Analytics (UEBA), baselining normal activity for users, service accounts, and entities, and tuning anomaly detections to surface meaningful risk while minimizing analyst fatigue
- Set strategy for SIEM log onboarding, parsers, filters, and ingestion pipelines, balancing signal fidelity against cost and aligning telemetry with detection priorities
- Build and curate advanced KQL libraries, hunting notebooks, and automations (Logic Apps, playbooks, SOAR-style workflows) that elevate the team's capability and accelerate triage, enrichment, and response
- Continuously benchmark detection coverage against current adversary tradecraft
- Lead a proactive, hypothesis-driven threat hunting program: define methodology, set cadence, and own outcomes across endpoints, identity, email, cloud workloads, and SaaS, leveraging Sentinel, Defender XDR Advanced Hunting, and other tools
- Translate industry, sector, and geopolitical threat intelligence into actionable detections, hunts, and architectural improvements
- Mature the threat hunting program over time, ensuring documented hypotheses, tracked coverage gaps, and a durable feedback loop into detection engineering and architecture
- Serve as the lead technical responder during significant security incidents, directing investigation, containment, eradication, and recovery under the CISO's overall incident leadership, partnering with an existing MDR provider and other external resources as appropriate
- Lead deep-dive forensic analysis across Microsoft 365, Entra ID, Azure, endpoints, email, and network telemetry; reconstruct attacker activity; produce clear, defensible findings for executive and client audiences
- Author and maintain incident response playbooks; co-lead tabletop exercises and after-action reviews; ensure lessons learned become durable engineering and architectural improvements
- Lead technical execution of the identity security strategy, guiding architectural decisions across Entra ID, including Conditional Access, Privileged Identity Management, Identity Protection, and risk-based authentication, aligned to a Zero Trust strategy
- Partner on the design and operation of data protection controls such as Microsoft Purview information protection, DLP, insider risk management, and eDiscovery
- Drive secure configuration baselines for Microsoft 365 and Azure workloads, including CIS benchmarks, Microsoft Secure Score, and organization-specific hardening standards
- Serve as the senior technical voice within the security team; mentor analysts and engineers, raise the bar on detection, hunting, and response, and contribute to hiring decisions for the function
- Support the CISO in client security reviews, third-party audits, and regulatory inquiries; act as a primary technical voice during high-stakes external engagements
- Help shape the organization's security culture through clear, credible communication with non-technical audiences
Skills
- Candidates requiring sponsorship, now or in the future, will not be considered for this role
- Ten or more years of progressive experience in information security, including substantial time as a senior individual contributor in security engineering, detection engineering, or threat analysis roles
- A documented track record of leading security architecture and detection engineering initiatives end-to-end with measurable improvements to an organization's security posture
- Deep, hands-on mastery of the Microsoft enterprise security stack, including Entra ID, Conditional Access, Microsoft 365, Azure, Microsoft Sentinel, and the Microsoft Defender suite
- Demonstrated experience setting detection engineering strategy in a modern SIEM, including authoring and tuning high-fidelity analytics rules, implementing and tuning UEBA, and managing log sources and ingestion economics at scale; advanced proficiency with KQL is required
- Proven experience serving as the lead technical responder or incident commander on significant security incidents, including investigations spanning cloud identity, email, endpoints, and SaaS
- Fluency with adversary tradecraft and frameworks including MITRE ATT&CK, the cyber kill chain, and Zero Trust architectural principles
- Recognized strength across core security architecture domains: identity, endpoint, network, email, data protection, and cloud security
- Breadth across the security tool ecosystem beyond any single vendor; demonstrated ability to evaluate, compare, and recommend security technologies through structured assessment, with enough market knowledge to identify where current tools are the right fit and where gaps or alternatives merit consideration
- Scripting and automation depth in PowerShell and at least one general-purpose language (Python preferred) for detection, enrichment, response, and analytics workflows
- Relevant certifications are valued and, in some cases, may substitute for portions of the experience requirements: CISSP, GCIH, GCDA, GCFA, OSCP, and/or Microsoft certifications such as SC-100/200/300 and AZ-500
Benefits
- Remote from Denver, infrequent on site will be required
Company Overview