Security Operations Engineer

Description:
Hybrid 4 in either New York, NY or Pittsburgh, PA

The organization seeks a Security Operations Engineer to strengthen and operate a FedRAMP-aligned Azure environment using native Microsoft security tooling. The role will design detections, run incident response, and drive continuous monitoring with audit-ready evidence across NIST SP 800-53 control families. The engineer will collaborate with cloud engineering, platform teams, and compliance stakeholders to sustain authorization and operational excellence. The position requires proficiency with Microsoft Sentinel, Defender for Cloud, Azure Policy, Entra ID, and KQL.

This is a contract to hire opportunity. Applicants must be willing and able to work on a w2 basis and convert to FTE following contract duration. For our w2 consultants, we offer a great benefits package that includes Medical, Dental, and Vision benefits, 401k with company matching, and life insurance.

Rate: $84.00 to $94.00/hr. w2

Responsibilities:

• Design, implement, and tune detections in Microsoft Sentinel, including analytic rules, workbooks, watchlists, and automation with Logic Apps and Playbooks.
• Build incident response runbooks and orchestration for triage, enrichment, and response using Sentinel automation.
• Maintain log onboarding pipelines, data connectors, and normalization in Log Analytics to ensure coverage for in-scope resources.
• Conduct daily SecOps functions including alert triage, investigation, threat hunting, containment, and post-incident reviews.
• Leverage Defender for Cloud, Defender for Cloud Apps, Entra ID Protection, and Microsoft Defender XDR signals to correlate and respond to threats.
• Document evidence and maintain audit-ready case records, contributing to POA&M entries and corrective actions.
• Manage misconfigurations and control enforcement using Defender for Cloud recommendations, Secure Score, and Azure Policy.
• Partner with platform engineering to remediate vulnerabilities and configuration drift, tracking closures against FedRAMP timelines.
• Maintain baseline guardrails via Azure Policy and Blueprints and monitor compliance and exceptions with Continuous Monitoring reporting.
• Implement and support least-privilege patterns with Entra ID, PIM, Conditional Access, RBAC, and managed identities.
• Coordinate FIPS 140-2 validated cryptography usage with Key Vault and ensure encryption standards at rest and in transit are met and evidenced.
• Operate Azure Firewall, NSGs, Private Link, and DDoS Protection and monitor and remediate anomalies.
• Ensure logging and telemetry for network controls are complete, retained, and queryable within Sentinel.
• Produce monthly and quarterly Continuous Monitoring artifacts and maintain supporting evidence.
• Update detection coverage maps, control implementation narratives, and operational runbooks as environment changes occur.
• Collaborate with compliance and assessors, support interviews, evidence collection, and remediation tracking.
• Embed security checks into CI/CD pipelines using native integrations and support policy compliance and validation.
• Enforce disciplined change processes and ensure changes are reflected in the SSP, control evidence, and detections.

Experience Requirements:

• 5+ years in security operations engineering or incident response, including 2+ years operating native Microsoft security tooling in Azure.
• Hands-on experience building and tuning Microsoft Sentinel detections and automating response with Logic Apps and Playbooks.
• Practical knowledge of FedRAMP Moderate or High baselines and NIST SP 800-53 control families relevant to operations, including AC, AU, CM, IR, RA, SC, and SI.
• Proficiency with Defender for Cloud, Azure Policy, Entra ID including PIM and Conditional Access, Key Vault, Azure Monitor, and Log Analytics.
• Strong incident response skills across triage, investigation, containment, and post-incident documentation with audit-quality evidence.
• Experience operating vulnerability and misconfiguration management workflows and meeting remediation SLAs aligned to FedRAMP timelines.
• Scripting and automation familiarity using KQL for Sentinel and PowerShell, with ARM, Bicep, or Terraform basics.
• Excellent documentation and communication skills for playbooks, evidence packages, and stakeholder updates.
• Experience with Azure Government or GCC High environments (preferred).
• Prior contributions to FedRAMP Continuous Monitoring reporting and POA&M lifecycle management (preferred).
• Experience aligning native controls and detections to payment or mission-critical workload risk profiles (preferred).
• Familiarity with Microsoft Purview, Defender for Cloud Apps, Entra ID Protection, and Private Link patterns (preferred).
• Certifications such as AZ-500, SC-200, CISSP, or CCSP (preferred).

Education Requirements:

• Relevant professional certifications such as AZ-500 Azure Security Engineer Associate (preferred).
• SC-200 Microsoft Security Operations Analyst (preferred).
• CISSP or CCSP certification (preferred).