Sr. Cybersecurity Engineer, Detection & Response

is building the backbone of energy and AI infrastructure powering grid-safe data centers and mission-critical facilities. The company supplies and operates hyperscale power systems that solve the toughest resilience challenges delivering custom solutions for AI data centers mission-critical facilities and front-of-the-meter assets. ON recently announced a 5GW partnership with 3GW currently under construction across multiple hyperscale data center campuses. With patented technology and proprietary softwaredevelops projects worldwide that set new benchmarks for resilience.

is hiring a Sr. Cybersecurity Engineer to run detection and response across the corporate security stack: the SIEM the Defender suite SaaS applications and the data moving through them. A growing energy business generates significant signal across these four surfaces and most of it currently goes unread. This is a SecOps role focused on detection ownership response speed and incident resolution. The underlying platforms that generate the telemetry are built and governed by other functions. This role owns turning that signal into alerts that matter and incidents that get closed.

Detection Engineering & Incident Response

• SIEM (Microsoft Sentinel): Deploy and own Sentinel in the Defender portal data connectors across Entra Defender XDR M365 AWS and SaaS sources plus the retention and tiering decisions that keep ingestion cost defensible.
• Detection Engineering: Write and tune analytics rules and custom detections in KQL mapped to MITRE ATT&CK. Run the tuning board; every rule requires a documented reason to exist and noisy rules get fixed or killed.
• Incident Response: Own the IR lifecycle end to end for anything surfaced through Sentinel: triage containment eradication and written post-incident review. Maintain playbooks for top scenarios (BEC ransomware credential compromise third-party breach DLP/insider risk escalation) run tabletops with IT Legal and Operations leadership and lead the corporate side of any incident that crosses into OT.

Endpoint Email App & Data Security

• Endpoint & Email (Defender): Own triage and response for Defender for Endpoint and Defender for Office 365 alerts: investigate contain and close the loop back into Sentinel detections. Does not own EDR policy architecture ASR baselines or the Intune device compliance program; that build sits with Endpoint/IT Engineering. Consumes their telemetry and detects against it.
• App Security (Defender for Cloud Apps): Own detection logic for risky OAuth grants shadow IT and anomalous app behavior fed into Sentinel as first-class detections. Does not run the SaaS app approval and governance program itself; thats a GRC/IT governance function this role feeds not owns.
• Data Security (Purview): Own detection and response for DLP and insider risk alerts flowing into Sentinel: investigate matches determine real exposure and drive the incident through to close. Does not design label taxonomy or author insider risk policy; thats a data governance function partnered with Legal and HR. Responds to what it produces.

Governance Risk & Compliance

• Control Frameworks & Audit Support: Supply technical evidence and control-operation proof for SOC 2 ISO 27001 and NIST CSF 2.0 audits and answer technical questions in customer security questionnaires as directed by GRC. Does not own the audit relationship the control framework or the risk register; that sits with GRC. Proves the controls operated actually work.

Cloud Security

• Consume AWS GuardDuty findings into Sentinel and write detections against them. AWS security architecture and IAM least-privilege design belong to DevOps; this role owns the telemetry pipeline into the SIEM not that surface.

• 5 years of hands-on security operations and detection engineering experience with real depth in at least two of: endpoint email SaaS or data security telemetry and hands-on ownership of incident response.

Technical Stack Proficiency:

• Microsoft Sentinel: Hands-on deployment data connectors and detections written in KQL. Comfortable tuning for signal quality and managing ingestion cost.
• Defender suite: Working knowledge of Defender for Endpoint Office 365 and Cloud Apps from a triage/response and detection-tuning angle not policy architecture.
• Purview: Experience investigating DLP and insider risk alerts and translating them into incident response not building the DLP program.
• Entra ID: Comfortable reading sign-in logs and Identity Protection risk signals for detection purposes at a light touch. Deep Conditional Access/PIM architecture experience is not required.
• Automation: KQL PowerShell Graph API or Python; sufficient to automate triage rather than perform it manually.

Required Background:

• Detection & Response Ownership: Demonstrated accountability for detection engineering and incident response outcomes across more than one telemetry source beyond working a queue inside someone elses program.
• Incident Response: Experience leading real incidents through post-incident review including briefing non-technical leadership.
• Compliance Support: Experience supplying technical evidence for a control framework audit (SOC 2 ISO 27001 NIST CSF or similar) as the technical operator without necessarily owning the audit relationship.

Core Traits:

• Hands-on: Prefers writing the KQL that proves an alert is real over describing how to write it.
• Signal-disciplined: Every rule shipped has a documented reason to exist and gets tuned or killed when it stops earning its alert volume.
• Evidence-disciplined: Documents while building shaped by experience on the wrong side of an audit sample where the control worked but the proof did not exist.
• Clear about lanes: Able to redirect an out-of-scope request to the correct owner without stalling the incident.

Preferred:

• Experience running SecOps in a hybrid Microsoft-and-AWS environment.
• Background in energy utilities industrial or another operationally critical sector with enough IT/OT context to partner with an OT security engineer.
• Certifications: SC-200 (Security Operations Analyst) CISSP GCIH GCIA or GCDA.

For US-based roles - What youll get:

• Competitive salary annual performance-based bonus eligibility
• Medical dental and vision insurance
• 401(k) with company match
• Paid time off and company holidays

For Mexico-based roles - What youll get:

• Competitive salary annual performance bonus eligibility
• Christmas Bonus (Aguinaldo): 30 days
• Major medical expenses and life insurance
• Paid time off and holidays (per local policy)

For all roles:

• Professional development and growth opportunities
• Opportunity to grow with a mission-driven team shaping the future of clean energy
• Equal Opportunity: is committed to equal employment opportunity and to maintaining a work environment free of harassment discrimination or retaliation.
• Accommodations: If you need an accommodation during the application process email
• Benefits vary by role and location and are subject to change.

Agency Notice: does not accept unsolicited resumes from staffing agencies search firms or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of . No placement fees or compensation will be paid for unsolicited candidate submissions.