Cybersecurity Engineer II

POSITION SUMMARY

The IT Cybersecurity Engineer II provides mid-level engineering support for the architecture, operation, automation, and continuous improvement of Orion's cybersecurity posture across on-premises, cloud, and hybrid environments. This role is responsible for evaluating and strengthening the overall security architecture, and for enhancing and automating existing security tooling to improve detection, response, and operational efficiency. The role also owns the security and integrity of Orion's SIEM and SOAR environment, ensuring the platforms that detect and respond to threats are themselves properly access-controlled, hardened, and monitored. The position holds global ownership of endpoint security review and administration, ensuring consistent policy enforcement, coverage, and hardening across the environment.

While the primary focus of this role is cybersecurity engineering, the Cybersecurity Engineer II is expected to be well-rounded across core infrastructure disciplines. The role actively cross-trains and provides backup support with the Infrastructure team and participates in shared operational and on-call responsibilities. This role works under the direction of IT leadership while partnering with the Infrastructure team, Service Desk, Applications, and business stakeholders to maintain a secure, resilient, and well-documented technology environment.

This role supports cybersecurity technologies and services including endpoint detection and response (EDR/XDR), network detection and response (NDR), SIEM and SOAR platforms, identity security, email security, vulnerability management, security monitoring and alerting, and security automation, in addition to cross-functional support of virtualization, backup, and related on-premises infrastructure.

The incumbent must support Orion's guiding beliefs and core values centered on

Safety ,

Quality ,

Delivery , and

Teamwork , and most importantly, built upon the all-important foundation of

Integrity .

SPECIFIC RESPONSIBILITIES

Cybersecurity architecture and posture Evaluate Orion's overall cybersecurity architecture and posture, identifying gaps and recommending improvements aligned with security best practices and industry frameworks (for example, NIST, CIS Controls, Zero Trust principles). Partner with IT leadership to design and evolve a layered security architecture across endpoint, network, identity, email, and cloud environments, informed by findings from penetration tests, vulnerability assessments, and audits. Translate penetration test and assessment findings into prioritized remediation plans and architectural changes, tracking implementation through to closure. Security tooling enhancement and automation

Serve as the primary engineer responsible for enhancing, tuning, and automating Orion's core security platforms, including Darktrace and Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365). Develop and maintain automation, scripts, and workflows (for example, PowerShell, KQL, Logic Apps/Sentinel automation, or equivalent) to streamline detection, alert triage, response actions, and reporting, reducing manual security operations effort. Continuously tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve signal quality across security platforms. Evaluate emerging security tools and capabilities and recommend enhancements or additions to the security tooling stack. SIEM and SOAR platform security

Own the security, access control, and configuration integrity of Orion's SIEM and SOAR environment, ensuring the platforms responsible for detection, correlation, and automated response are themselves hardened against unauthorized access, tampering, or misconfiguration. Administer role-based access, log source onboarding, and data retention within the SIEM to protect the confidentiality and integrity of security event data used for detection, investigation, and audit evidence. Build, test, and maintain SOAR playbooks and automated response actions, applying change control and peer review to prevent unintended or unauthorized automated actions in production. Monitor SIEM/SOAR platform health, log ingestion completeness, and playbook execution to ensure detection and response coverage is not silently degraded. Endpoint security ownership

Own the global review, configuration, and administration of endpoint security, across all Orion locations, devices, and business units. Monitor endpoint security coverage, policy compliance, and protection status; identify and remediate gaps in onboarding, policy application, or protection posture. Manage endpoint security policies, attack surface reduction rules, device configuration baselines, and vulnerability management workflows tied to endpoint protection. Review and respond t