Sr. Cybersecurity Engineer, Detection & Response

ON.energy is hiring a Sr. Cybersecurity Engineer to run detection and response across the corporate security stack: the SIEM, the Defender suite, SaaS applications, and the data moving through them. A growing energy business generates significant signal across these four surfaces, and most of it currently goes unread. This is a SecOps role focused on detection ownership, response speed, and incident resolution. The underlying platforms that generate the telemetry are built and governed by other functions. This role owns turning that signal into alerts that matter and incidents that get closed.

Key Responsibilities

Detection Engineering & Incident Response

• SIEM (Microsoft Sentinel): Deploy and own Sentinel in the Defender portal, data connectors across Entra, Defender XDR, M365, AWS, and SaaS sources, plus the retention and tiering decisions that keep ingestion cost defensible.
• Detection Engineering: Write and tune analytics rules and custom detections in KQL, mapped to MITRE ATT&CK. Run the tuning board; every rule requires a documented reason to exist, and noisy rules get fixed or killed.
• Incident Response: Own the IR lifecycle end to end for anything surfaced through Sentinel: triage, containment, eradication, and written post-incident review. Maintain playbooks for top scenarios (BEC, ransomware, credential compromise, third-party breach, DLP/insider risk escalation), run tabletops with IT, Legal, and Operations leadership, and lead the corporate side of any incident that crosses into OT.

Endpoint, Email, App & Data Security

• Endpoint & Email (Defender): Own triage and response for Defender for Endpoint and Defender for Office 365 alerts: investigate, contain, and close the loop back into Sentinel detections. Does not own EDR policy architecture, ASR baselines, or the Intune device compliance program; that build sits with Endpoint/IT Engineering. Consumes their telemetry and detects against it.
• App Security (Defender for Cloud Apps): Own detection logic for risky OAuth grants, shadow IT, and anomalous app behavior, fed into Sentinel as first-class detections. Does not run the SaaS app approval and governance program itself; that's a GRC/IT governance function this role feeds, not owns.
• Data Security (Purview): Own detection and response for DLP and insider risk alerts flowing into Sentinel: investigate matches, determine real exposure, and drive the incident through to close. Does not design label taxonomy or author insider risk policy; that's a data governance function partnered with Legal and HR. Responds to what it produces.

Governance, Risk & Compliance

• Control Frameworks & Audit Support: Supply technical evidence and control-operation proof for SOC 2, ISO 27001, and NIST CSF 2.0 audits, and answer technical questions in customer security questionnaires, as directed by GRC. Does not own the audit relationship, the control framework, or the risk register; that sits with GRC. Proves the controls operated actually work.

Cloud Security

• Consume AWS GuardDuty findings into Sentinel and write detections against them. AWS security architecture and IAM least-privilege design belong to DevOps; this role owns the telemetry pipeline into the SIEM, not that surface.

Requirements

• 5+ years of hands-on security operations and detection engineering experience, with real depth in at least two of: endpoint, email, SaaS, or data security telemetry, and hands-on ownership of incident response.

Technical Stack Proficiency:

• Microsoft Sentinel: Hands-on deployment, data connectors, and detections written in KQL. Comfortable tuning for signal quality and managing ingestion cost.
• Defender suite: Working knowledge of Defender for Endpoint, Office 365, and Cloud Apps from a triage/response and detection-tuning angle, not policy architecture.
• Purview: Experience investigating DLP and insider risk alerts and translating them into incident response, not building the DLP program.
• Entra ID: Comfortable reading sign-in logs and Identity Protection risk signals for detection purposes, at a light touch. Deep Conditional Access/PIM architecture experience is not required.
• Automation: KQL, PowerShell, Graph API, or Python; sufficient to automate triage rather than perform it manually.

Required Background:

• Detection & Response Ownership: Demonstrated accountability for detection engineering and incident response outcomes across more than one telemetry source, beyond working a queue inside someone else's program.
• Incident Response: Experience leading real incidents through post-incident review, including briefing non-technical leadership.
• Compliance Support: Experience supplying technical evidence for a control framework audit (SOC 2, ISO 27001, NIST CSF, or similar) as the technical operator, without necessarily owning the audit relationship.

Core Traits:

• Hands-on: Prefers writing the KQL that proves an alert is real over describing how to write it.
• Signal-disciplined: Every rule shipped has a documented reason to exist and gets tuned or killed when it stops earning its alert volume.
• Evidence-disciplined: Documents while building, shaped by experience on the wrong side of an audit sample where the control worked but the proof did not exist.
• Clear about lanes: Able to redirect an out-of-scope request to the correct owner without stalling the incident.

Preferred:

• Experience running SecOps in a hybrid Microsoft-and-AWS environment.
• Background in energy, utilities, industrial, or another operationally critical sector, with enough IT/OT context to partner with an OT security engineer.
• Certifications: SC-200 (Security Operations Analyst), CISSP, GCIH, GCIA, or GCDA.