Security Engineer III

As a Security Engineer III, you will lead the design, deployment, and ongoing management of secure Microsoft 365 GCC High environments for Marco’s CMMC-regulated customers. You will drive automation initiatives to streamline security operations, reduce ticket volume from our MDR provider, and deliver efficient, scalable incident response and vulnerability remediation. This position serves as a senior technical resource for customer environment hardening, compliance alignment, and security service delivery across Marco’s managed security portfolio.

ESSENTIAL FUNCTIONS:

• Lead the provisioning, configuration, and ongoing management of Microsoft 365 GCC High environments for CMMC-regulated customers, ensuring alignment with CMMC Level 2 and Level 3 requirements and DoD security standards.
• Design and implement secure baseline configurations for Microsoft 365 GCC High, including conditional access policies, data governance, identity and access management, and compliance controls aligned to CMMC and NIST SP 800-171.
• Serve as a primary technical resource for CMMC customer onboarding, environment hardening, compliance gap remediation, and ongoing support within managed Microsoft 365 GCC High tenants.
• Develop and implement automation workflows to streamline security ticket triage, response, and resolution—reducing manual effort and ticket volume originating from Marco’s MDR provider.
• Analyze MDR alert trends and recurring incident patterns to identify root causes and engineer automated or procedural responses that drive service efficiency and reduce mean time to respond (MTTR).
• Lead customer security incident response activities, including investigation, containment, eradication, and recovery within managed customer environments, ensuring timely communication and post-incident reporting.
• Perform proactive vulnerability management and remediation across customer environments, prioritizing based on risk, exploitability, and customer compliance obligations.
• Manage competing priorities and set expectations with stakeholders through proactive communication, planning, and documentation of technical requirements and outcomes.
• Be a point of escalation within the team to handle and resolve complex security issues, involving direct management as needed.
• Respond in a timely manner to tickets and incidents within established procedures, and contribute to best practices, knowledge base articles, and process documentation.
• Stay up to date with relevant technology, emerging threat intelligence, and regulatory changes affecting CMMC, FedRAMP, and government cloud environments.
• Accurately maintain and comply with documentation, communication, time entry, and administrative procedures in a timely manner.
• Participate in on-call rotation and after-hours work as required.

QUALIFICATIONS:

• Bachelor’s degree in computer science, cybersecurity, information security, or a related field or equivalent experience in lieu of education
• Minimum of 8 years of experience in information technology and information security, with experience working in managed security services or security operations
• Proven experience with Microsoft 365 administration and security configuration, with hands-on experience in GCC High or other government cloud environments strongly preferred.
• One or more of the following certifications is strongly preferred: Microsoft Certified: Security Operations Analyst (SC-200), Information Protection Administrator (SC-400), or Identity and Access Administrator (SC-300); CompTIA Security+, CySA+, or CASP+; or CISSP/equivalent; Certified CMMC Professional (CCP) or Certified CMMC Assessor (CCA) a plus.

REQUIRED SKILLS:

• Advanced experience with five or more of the following:
  
  • Microsoft 365 GCC High administration and secure configuration
  • CMMC compliance frameworks (Level 2 and/or Level 3) and NIST SP 800-171
  • Endpoint detection and response (EDR) solutions and SIEM platforms
  • Vulnerability management and remediation workflows
  • Email security solutions and Microsoft Defender suite
  • Network and host firewalls and network architecture
  • Microsoft Azure and Entra ID (Azure AD) in government cloud or FedRAMP-authorized environments
• Demonstrated experience developing automation using PowerShell, Python, or similar scripting languages for security operations use cases, including alert triage, ticket routing, and automated response playbooks.
• Experience working with MDR providers, interpreting alert feeds, and building automation or process improvements to reduce tier-1 ticket volume and improve analyst efficiency.
• Experience conducting or supporting customer security incident response, inclu