Security Operations (SecOps) Engineer

Role: Security Operations (SecOps) Engineer 102220-1

Duration: 12+ months

Location: New York, NY or Pittsburgh, PA (4 days onsite required weekly from day one)

Interview: Video

Primary Tooling (Native Microsoft Focus)

• SIEM/SOAR: Microsoft Sentinel (Log Analytics, Workbooks, Playbooks/Logic Apps).
• Cloud posture and vulnerability: Microsoft Defender for Cloud, Secure Score, regulatory compliance dashboards.
• Identity and access: Entra ID (Azure AD), PIM, Conditional Access, RBAC, Managed Identities.
• Data protection and governance: Azure Key Vault (FIPS 140-2), Microsoft Purview (as applicable).
• Policy and baselining: Azure Policy, Azure Blueprints, Azure Automation.
• Monitoring/telemetry: Azure Monitor, Log Analytics, Activity Logs, Diagnostic Settings.
• Network security: Azure Firewall, NSGs, Private Link, DDoS Protection (Standard).
• Endpoint/XDR: Microsoft Defender XDR signals (as applicable to scope).

Required Qualifications

• 5+ years in security operations engineering or incident response, with 2+ years operating native Microsoft security tooling in Azure.
• Hands-on experience building and tuning detections in Microsoft Sentinel and automating response with Logic Apps/Playbooks.
• Practical knowledge of FedRAMP baselines (Moderate/High) and NIST SP 800-53 control families relevant to operations (AC, AU, CM, IR, RA, SC, SI).
• Proficiency with Azure security services: Defender for Cloud, Azure Policy, Entra ID (PIM/Conditional Access), Key Vault, Azure Monitor/Log Analytics.
• Strong incident response skills: triage, investigation, containment, and post-incident documentation with audit-quality evidence.
• Experience operating vulnerability/misconfiguration management workflows and meeting remediation SLAs aligned to FedRAMP timelines.
• Scripting/automation familiarity (KQL for Sentinel, PowerShell, ARM/Bicep/Terraform basics) to support detection, onboarding, and evidence generation.
• Excellent documentation and communication skills for playbooks, evidence packages, and stakeholder updates.

Preferred Qualifications

• Experience with Azure Government C High environments and their control/telemetry nuances.
• Prior contributions to FedRAMP Continuous Monitoring reporting and POA&M lifecycle management.
• Experience integrating native controls with payment or mission-critical workloads and aligning detections to transactional risk profiles.
• Familiarity with Microsoft Purview, Defender for Cloud Apps, Entra ID Protection, and Private Link patterns for sensitive services.
• Certifications: AZ-500 (Azure Security Engineer Associate), SC-200 (Microsoft Security Operations Analyst), CISSP, CCSP, or equivalent.

Raj Kiran