Cybersecurity Engineer

Environmental Science Associates (ESA) is a 100% employee-owned environmental consulting firm. We plan, design, permit, mitigate, and restore for projects across our communities, infrastructure systems, open spaces, and wildlands. We are 50 years strong in 21 offices across California, the Pacific Northwest, and the Southeastern United States.

Environmental Science Associates (ESA) is looking for a Cybersecurity Engineer who wants to do more than monitor alerts. In this role, you will help strengthen and evolve the security program of a 100% employee-owned environmental consulting firm while protecting the systems, information, and technology our people rely on to deliver important work for clients across the country. You will join a collaborative technology team and work across security operations, cloud and endpoint security, identity and access management, threat detection, incident response, federal cybersecurity compliance, and emerging AI security.

This role is ideal for someone with a strong foundation in Microsoft security who enjoys investigating complex problems, strengthening security controls, and developing practical solutions to emerging threats. You will have meaningful opportunities to help shape how we secure new technologies, including AI-enabled systems, as they are adopted across the firm. This is a hybrid role with working onsite a few days per week in either our Portland, OR, and/or Seattle, WA offices. 

What You Will Do

Strengthen ESA's Security Posture. Help evaluate, configure, and continuously improve security across endpoints, servers, cloud services, identities, and network environments. You will work extensively within ESA's Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud, Entra ID, and Intune.

Detect and Respond to Threats. Monitor and investigate suspicious activity using Sentinel and Defender XDR. Perform alert triage, log analysis, and threat hunting; use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry; tune detections to improve signal quality; and partner with ESA's Security Operations Center to investigate and resolve escalated incidents.

Advance Zero Trust Security. Help strengthen ESA's identity and device security using Conditional Access, multifactor authentication, least-privilege access, device compliance, and identity monitoring consistent with NIST and CISA Zero Trust principles.

Support Incident Response. Help develop, test, and execute security incident response procedures and playbooks. During an incident, you will assist with investigation, containment, evidence preservation, escalation, endpoint isolation, or disabling compromised accounts while coordinating with internal teams and external security partners.