Cybersecurity Engineer

Environmental Science Associates (ESA) is a 100% employee-owned environmental consulting firm. We plan design permit mitigate and restore for projects across our communities infrastructure systems open spaces and wildlands. We are 50 years strong in 21 offices across California the Pacific Northwest and the Southeastern United States.

Environmental Science Associates (ESA) is looking for a Cybersecurity Engineer who wants to do more than monitor this role you will help strengthen and evolve the security program of a 100% employee-owned environmental consulting firm while protecting the systems information and technology our people rely on to deliver important work for clients across the will join a collaborative technology team and work across security operations cloud and endpoint security identity and access management threat detection incident response federal cybersecurity compliance and emerging AI security.

This role is ideal for someone with a strong foundation in Microsoft security who enjoys investigating complex problems strengthening security controls and developing practical solutions to emerging threats. You will have meaningful opportunities to help shape how we secure new technologies including AI-enabled systems as they are adopted across the firm. This is a hybrid role with working onsite a few days per week in either our Portland OR and/or Seattle WA offices.

What You Will Do

Strengthen ESAs Security Posture. Help evaluate configure and continuously improve security across endpoints servers cloud services identities and network environments. You will work extensively within ESAs Microsoft security ecosystem including Microsoft Sentinel Defender XDR Defender for Endpoint Defender for Office 365 Defender for Identity Defender for Cloud Entra ID and Intune.

Detect and Respond to Threats. Monitor and investigate suspicious activity using Sentinel and Defender XDR. Perform alert triage log analysis and threat hunting; use Kusto Query Language (KQL) and Advanced Hunting to investigate security telemetry; tune detections to improve signal quality; and partner with ESAs Security Operations Center to investigate and resolve escalated incidents.

Advance Zero Trust Security. Help strengthen ESAs identity and device security using Conditional Access multifactor authentication least-privilege access device compliance and identity monitoring consistent with NIST and CISA Zero Trust principles.

Support Incident Response. Help develop test and execute security incident response procedures and playbooks. During an incident you will assist with investigation containment evidence preservation escalation endpoint isolation or disabling compromised accounts while coordinating with internal teams and external security partners.

Help Secure ESAs Use of AI. Work at the forefront of an evolving area of cybersecurity by helping ESA securely adopt AI systems agents models MCP servers connectors and related technologies. You will help identify and mitigate risks including shadow AI prompt injection sensitive-data disclosure excessive agent permissions identity impersonation poisoned data sources compromised connectors and insecure model outputs.

You will also help develop monitoring and incident-response approaches for AI-enabled systems and use AI-assisted security tools including Microsoft Security Copilot while validating AI-generated findings against authoritative source data and security telemetry.

Support NIST and CMMC Compliance. Help maintain ESAs NIST-based cybersecurity program and support environments involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). You will contribute to NIST SP 800-53 and NIST SP 800-171 control mapping System Security Plans Plans of Action and Milestones evidence collection remediation tracking CUI scoping CMMC readiness and SPRS assessment activities.

Improve and Automate Security Operations. Evaluate emerging security tools technologies and techniques and identify opportunities to improve detection and response through automation tools.

Collaborate and Build Security Awareness. Work closely with IT colleagues technology leadership employees clients external security providers and auditors. Help translate complex security concepts into practical guidance and contribute to security education and awareness across ESA.

What You Will Ideally Bring

• 35 years of progressively responsible cybersecurity experience including hands-on security operations or security engineering experience.
• Experience across several areas such as endpoint security identity and access management cloud security network security and monitoring vulnerability management SIEM/log analysis incident response secure configuration or security automation.
• Hands-on experience with Microsoft Defender XDR and at least two Microsoft security technologies such as Defender for Endpoint Defender for Office 365 Defender for Identity Defender for Cloud Apps Defender for Cloud Microsoft Entra ID or Microsoft Intune.
• Experience with Microsoft Sentinel or a comparable SIEM including investigating alerts reviewing telemetry and supporting analytics and detection rules.
• Ability to use or demonstrated ability to quickly develop proficiency in Kusto Query Language (KQL).
• Working knowledge of NIST SP 800-53 NIST SP 800-171 and CMMC within a federal contracting environment including CUI scoping System Security Plans POA&Ms and evidence collection.
• Working knowledge of security incident response including alert triage containment escalation evidence preservation documentation and coordination with internal and external security teams.
• Awareness of emerging AI cybersecurity risks including shadow AI prompt injection sensitive-data exposure compromised data sources and dependencies excessive agent permissions and identity impersonation.
• The judgment to critically evaluate AI-generated security findings and validate recommendations against source telemetry authoritative guidance and established security procedures.
• Ability to manage competing priorities and respond appropriately to occasional after-hours security incidents audits or maintenance activities.
• Bachelors degree in Cybersecurity Computer Science Information Systems or an equivalent combination of education professional training certifications and relevant experience.

Just as important you are curious collaborative and accountable. You enjoy understanding how things work investigating what does not look right and finding practical ways to make systems more secure. You can work independently while knowing when to escalate an issue and you communicate technical security risks in a way that helps others make informed decisions.

Preferred Qualifications

We would be especially interested in candidates who bring one or more of the following:

• Cybersecurity certifications such as CompTIA Security CySA SSCP GIAC or comparable credentials.
• Microsoft certifications such as SC-200 AZ-500 or SC-300.
• Experience supporting a federal contractor or organization subject to CMMC FAR DFARS NIST SP 800-171 or related federal cybersecurity requirements.
• Experience supporting a CMMC or NIST assessment penetration test tabletop exercise external cybersecurity assessment or third-party audit.
• Experience with CUI asset inventories data-flow documentation security-control assessments SPRS submissions assessment evidence or federal cyber-incident reporting.
• Hands-on experience with Entra Conditional Access MFA Privileged Identity Management device-compliance policies DLP or Microsoft Purview sensitivity labels.
• Experience with vulnerability management and security automation using technologies such as Microsoft Defender Vulnerability Management PowerShell or Azure Logic Apps.
• Familiarity with the NIST AI Risk Management Framework NIST Generative AI Profile or OWASP guidance for generative AI and LLM applications.
• Familiarity with secure software-development practices including threat modeling secrets management dependency and code scanning API security and CI/CD security.

Why ESA

At ESA cybersecurity is not simply about implementing controls. We enable our employee-owners to work confidently protect our clients and information meet increasingly sophisticated cybersecurity requirements and help the firm adopt new technologies responsibly.

Youll have the opportunity to work across traditional and emerging cybersecurity challenges from Microsoft cloud security and threat hunting to CMMC readiness Zero Trust and AI security while contributing ideas that can directly influence how ESAs security program evolves.

If you are a security professional who likes to investigate build improve and solve problems and you want your work to have visible impact wed like to hear from you.

Who We Are

We are a 100% employee-owned environmental consulting firm who values diversity and inclusion and celebrate the differences that make each of us unique. Our culture is built on mutual respect recognizing that our variety of backgrounds experiences and perspectives leads to better solutions which fosters our continued success for our employee-owners and clients.

In accordance with ESAs duty and responsibility to provide and maintain a safe workplace that is free of known hazards and to minimize the exposure to potential hazards any employee who works from an ESA office or conducts any other in-person ESA work-related activity is required to submit their proof of vaccination status or have received an approved exemption and accommodation in states which this applies.

Please note: We do NOT accept unsolicited resumes from agencies

If you are an applicant with a disability that requires a reasonable accommodation to complete any part of the application process or are limited in the abilityor unable to usethe online application system and need an alternative method for applying you may contact our Human Resources Department via email:for assistance.

Please include the following in your message so we can promptly address your request:

• Full name
• The best method to contact you (phone number and/or email address)
• Title of Job Position Applied
• Description of your accommodation request

ESA is an Equal Opportunity Employer committed to a diverse and inclusive work environment. (EOEM/V/F/D)