Microsoft Cloud Security Engineer

Chevo LLC is seeking a Microsoft Cloud Security Engineer to serve as a Key Personnel on the DOI Office of Wildland Fire (OWF) FireNet Enterprise Business Services contract. FireNet is a Microsoft 365/Azure-based interagency collaboration platform supporting federal, state, tribal, and local wildland fire operations across DOI, USDA Forest Service, and non-federal partners. This role is essentially an O365 security engineer with experience with Entra ID and Azure system management. Chosen candidate will oversee the hands-on security engineering for the FireNet tenant and is expected to implement all recommendations in the necessary administration portals, including Microsoft Entra, Azure Portal, Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Exchange Online, Intune, and the Microsoft 365 Admin Center.

Duties & Responsibilities:

• Engineer, implement, and continuously improve the security posture of the FireNet Microsoft 365 and Azure environment.
• Configure and maintain Entra ID Conditional Access policies, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) to enforce a zero-trust, least-privilege posture across all privileged and high-risk roles.
• Manage guest and external identity lifecycle including entitlement management, access packages, and periodic access reviews in coordination with Government ISSOs and program stakeholders.
• Oversee Microsoft Secure Score and Identity Secure Score improvements, developing and executing a monthly action plan to achieve net-positive score improvements and remediating critical findings within 10 business days or an approved POA&M.
• Build administer and maintain Microsoft Defender for Cloud (including anti-phishing, anti-malware, Safe Links, Safe Attachments, and attack surface reduction controls.) and Microsoft Sentinel analytics rules, incident playbooks, KQL workbooks, and queries to detect and respond to threats across the tenant.
• Support Purview data loss prevention and sensitivity label implementation as authorized by the Government and ensure all logging and telemetry pipelines are configured for continuous monitoring IAW the DOI Continuous Monitoring Plan and FISMA requirements.
• Conduct threat hunting, vulnerability management, security assessments, and remediation activities using Microsoft security platforms and industry best practices.
• Provide on-call coverage for Priority 1 security and platform incidents, with expectations to acknowledge within 30 minutes, begin triage within 1 hour, and restore or implement a workaround within 4 hours.
• Lead technical incident response activities including investigation, containment, eradication, recovery, and post-incident reporting in coordination with IT Project Manager and Government stakeholders.
• Prepare CAB packets for security-scoped changes, coordinate with the Power Platform Lead and Web Development team on security controls and DevOps pipeline guardrails, and contribute to monthly Security Posture Reports and knowledge transfer documentation for Government ISSOs.
• Review and provide security architecture recommendations for new Azure, Microsoft 365, Power Platform, automation, and application integration initiatives to ensure alignment with Zero Trust and Federal security requirements.
• Develop and maintain security automation solutions using PowerShell, Microsoft Graph, Azure CLI, Logic Apps, or other approved tools to improve operational efficiency and consistency.

• Bachelor's degree in computer science, Information Security, Information Technology, or a related field preferred.
• Additional years of directly relevant experience may substitute for degree requirements consistent with the Contractor's MAS pricelist.
• Demonstrated, hands-on engineering enterprise Microsoft 365 and Azure security environments, including deep proficiency with Entra ID/Azure Active Directory, Conditional Access, PIM, MFA, and zero-trust architecture principles.
• Experience with Microsoft Defender for Cloud, Microsoft Sentinel, and KQL for custom analytics rules and threat hunting is required. You should be familiar with Microsoft Purview and data governance control within a government environment.
• Demonstrated experience with Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Intune, and endpoint security management is strongly preferred.
• Experience operating in DOI, FISMA, FedRAMP, or NIST 800-53 compliance environments is strongly preferred. Familiarity with DOI or other Federal agency security operations and authorization-to-operate (ATO/A&A) documentation is a plus.
• Experience developing administrative and security automation using PowerShell, Microsoft Graph API, Azure CLI, Logic Apps, or similar technologies is desirable.
• Must be able to obtain and maintain a Federal Public Trust (NACI) and be comfortable serving in an on-call capacity during national wildland fire preparedness seasons (National Preparedness Level 3-5).
• Relevant Microsoft certifications such as SC-100 (Cybersecurity Architect), SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator), or AZ-500 (Azure Security Engineer) are highly desirable and may substitute for certain experience requirements consistent with the GSA MAS pricelist.

SALARY RANGE: $145K - $170K (subject to change)

ELIGIBLE FOR PERFORMANCE BASE BONUS

Chevo offers a comprehensive benefits package including medical, dental and vision coverage, paid leave, observes all 11 federal government holidays, 401K plan with matching, monthly SMART card employer contribution for commuting expenses, tuition assistance and more!

Chevo, a Women-Owned Small Business (WOSB), has made Consulting Magazine's 2023 and 2024 "Best Firms to Work For" list and is a 2023, 2024, 2025, and 2026 Elev8 GovCon honoree. Chevo is a nine-time awardee of the Alliance for Workplace Excellence award; ranked one of the best Small Business Strategy firms by Consulting Magazine; made the Washington Technology Fast 50 list; and has earned multiple Program Management Industry awards.

Chevo is an Equal Opportunity Employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, disability, military status, national origin, or any other characteristic protected under federal, state, or applicable local law.