Cybersecurity Engineer

Environmental Science Associates (ESA) is looking for a Cybersecurity Engineer who wants to do more than monitor alerts. In this role, you will help strengthen and evolve the security program of a 100% employee-owned environmental consulting firm while protecting the systems, information, and technology our people rely on to deliver important work for clients across the country. You will join a collaborative technology team and work across security operations, cloud and endpoint security, identity and access management, threat detection, incident response, federal cybersecurity compliance, and emerging AI security.

This role is ideal for someone with a strong foundation in Microsoft security who enjoys investigating complex problems, strengthening security controls, and developing practical solutions to emerging threats. You will have meaningful opportunities to help shape how we secure new technologies, including AI-enabled systems, as they are adopted across the firm. This is a hybrid role with working onsite a few days per week in either our Portland, OR, and/or Seattle, WA offices.

What You Will Do

Strengthen ESA's Security Posture. Help evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and network environments. You will work extensively within ESA's Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra ID, and Intune.

Detect and Respond to Threats. Monitor and investigate suspicious activity using Sentinel and Defender XDR. Perform alert triage, log analysis, and threat hunting; use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry; tune detections to improve signal quality; and partner with ESA's Security Operations Center to investigate and resolve escalated incidents.

Advance Zero Trust Security. Help strengthen ESA's identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring consistent with NIST and CISA Zero Trust principles.

Support Incident Response. Help develop, test, and execute security incident response procedures and playbooks. During an incident, you will assist with investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts while coordinating with internal teams and external security partners.

Help Secure ESA's Use of AI. Work at the forefront of an evolving area of cybersecurity by helping ESA securely adopt AI systems, agents, models, MCP servers, connectors, and related technologies. You will help identify and mitigate risks including shadow AI, prompt injection, sensitive-data disclosure, excessive agent permissions, identity impersonation, poisoned data sources, compromised connectors, and insecure model outputs.

You will also help develop monitoring and incident-response approaches for AI-enabled systems and use AI-assisted security tools, including Microsoft Security Copilot, while validating AI-generated findings against authoritative source data and security telemetry.

Support NIST and CMMC Compliance. Help maintain ESA's NIST-based cybersecurity program and support environments involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). You will contribute to NIST SP 800-53 and NIST SP 800-171 control mapping, System Security Plans, Plans of Action and Milestones, evidence collection, remediation tracking, CUI scoping, CMMC readiness, and SPRS assessment activities.

Improve and Automate Security Operations. Evaluate emerging security tools, technologies, and techniques and identify opportunities to improve detection and response through automation tools.

Collaborate and Build Security Awareness. Work closely with IT colleagues, technology leadership, employees, clients, external security providers, and auditors. Help translate complex security concepts into practical guidance and contribute to security education and awareness across ESA.

What You Will Ideally Bring

• 3–5 years of progressively responsible cybersecurity experience, including hands-on security operations or security engineering experience.
• Experience across several areas such as endpoint security, identity and access management, cloud security, network security and monitoring, vulnerability management, SIEM/log analysis, incident response, secure configuration, or security automation.
• Hands-on experience with Microsoft Defender XDR and at least two Microsoft security technologies such as Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Entra ID, or Microsoft Intune.
• Experience with Microsoft Sentinel or a comparable SIEM, including investigating alerts, reviewing telemetry, and supporting analytics and detection rules.
• Ability to use or demonstrated ability to quickly develop proficiency in Kusto Query Language (KQL).
• Working knowledge of NIST SP 800-53, NIST SP 800-171, and CMMC within a federal contracting environment, including CUI scoping, System Security Plans, POA&Ms, and evidence collection.
• Working knowledge of security incident response, including alert triage, containment, escalation, evidence preservation, documentation, and coordination with internal and external security teams.
• Awareness of emerging AI cybersecurity risks, including shadow AI, prompt injection, sensitive-data exposure, compromised data sources and dependencies, excessive agent permissions, and identity impersonation.
• The judgment to critically evaluate AI-generated security findings and validate recommendations against source telemetry, authoritative guidance, and established security procedures.
• Ability to manage competing priorities and respond appropriately to occasional after-hours security incidents, audits, or maintenance activities.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or an equivalent combination of education, professional training, certifications, and relevant experience.

Just as important, you are curious, collaborative, and accountable. You enjoy understanding how things work, investigating what does not look right, and finding practical ways to make systems more secure. You can work independently while knowing when to escalate an issue, and you communicate technical security risks in a way that helps others make informed decisions.

Preferred Qualifications

We would be especially interested in candidates who bring one or more of the following:

• Cybersecurity certifications such as CompTIA Security+, CySA+, SSCP, GIAC, or comparable credentials.
• Microsoft certifications such as SC-200, AZ-500, or SC-300.
• Experience supporting a federal contractor or organization subject to CMMC, FAR, DFARS, NIST SP 800-171, or related federal cybersecurity requirements.
• Experience supporting a CMMC or NIST assessment, penetration test, tabletop exercise, external cybersecurity assessment, or third-party audit.
• Experience with CUI asset inventories, data-flow documentation, security-control assessments, SPRS submissions, assessment evidence, or federal cyber-incident reporting.
• Hands-on experience with Entra Conditional Access, MFA, Privileged Identity Management, device-compliance policies, DLP, or Microsoft Purview sensitivity labels.
• Experience with vulnerability management and security automation using technologies such as Microsoft Defender Vulnerability Management, PowerShell, or Azure Logic Apps.
• Familiarity with the NIST AI Risk Management Framework, NIST Generative AI Profile, or OWASP guidance for generative AI and LLM applications.
• Familiarity with secure software-development practices, including threat modeling, secrets management, dependency and code scanning, API security, and CI/CD security.

Why ESA

At ESA, cybersecurity is not simply about implementing controls. We enable our employee-owners to work confidently, protect our clients and information, meet increasingly sophisticated cybersecurity requirements, and help the firm adopt new technologies responsibly.

You'll have the opportunity to work across traditional and emerging cybersecurity challenges, from Microsoft cloud security and threat hunting to CMMC readiness, Zero Trust, and AI security while contributing ideas that can directly influence how ESA's security program evolves.

If you are a security professional who likes to investigate, build, improve, and solve problems and you want your work to have visible impact, we'd like to hear from you.