Principal Security Operations Engineer

What you'll do

• Manage end-to-end cybersecurity incidents including detection, severity assessment, containment, recovery, and root-cause analysis.
• Conduct insider and external threat investigations while producing defensible narratives for executive, legal, and compliance review.
• Define requirements, architecture, and engineering backlogs for an AI-enabled Security Operations Center (SOC).
• Translate AI SOC needs into measurable capabilities and evaluate third-party solutions for production readiness.
• Design, implement, and tune insider threat and cybersecurity detections within Microsoft Sentinel and other platforms.
• Onboard and normalize new security data streams to identify visibility gaps and improve monitoring coverage.
• Lead cross-functional incident response efforts involving legal, HR, national security, and global trade teams.
• Convert incident findings into improved detection rules, automated runbooks, and updated operating procedures.

What we're looking for

• A Bachelor's degree plus 6 years of experience in fields like computer science or cybersecurity is required (or equivalent).
• A Master's degree plus 4 years of experience in software development, threat modeling, or security operations is required (or equivalent).
• A Doctorate plus 3 years of experience in related technical fields is required (or equivalent).
• Candidates must provide proof of citizenship, permanent residency, or other protected status to access export-controlled information.
• Candidates must pass a Microsoft Cloud Background Check.
• Experience leading complex security incidents from investigation through executive communication and remediation is preferred.
• Hands-on experience with Microsoft Sentinel (KQL) or an equivalent enterprise SIEM is preferred.
• Relevant certifications such as CISSP, CISA, CISM, SANS, OSCP, or Security+ are preferred.