Staff Engineer - Cybersecurity

Dutch Bros Coffee • Phoenix, IL

13d • Hybrid

About The Position

It's fun to work in a company where people truly believe in what they are doing. At Dutch Bros Coffee, we are more than just a coffee company. We are a fun-loving, mind-blowing company that makes a difference one cup at a time. Position Overview: A Staff Engineer - Cybersecurity acts as a technical force multiplier by designing "paved road" architectures that make security the default state for all engineering teams. They move beyond individual fixes to build automated guardrails within the CI/CD pipeline, ensuring the organization scales securely without sacrificing velocity. By bridging the gap between deep technical risk and business strategy, they influence long-term infrastructure decisions and elevate the entire department’s security culture through high-level mentorship and cross-functional leadership. Reporting directly to the CISO, you will be the leading technical voice on security strategy, architecture, and engineering execution across the enterprise. You will lead and partner to implement and optimize our Microsoft security ecosystem (Entra ID, Defender, Sentinel, Purview), and provide engineer direction to mature our SIEM, SOAR, and SecOps capabilities, and strengthen our hybrid cloud security posture across Azure, AWS, and on-premises environments. You will shape detection engineering strategy, automate security operations at scale, and ensure our platforms deliver maximum protection and operational efficiency.

Requirements

• 7+ years of hands-on experience in security engineering roles.
• 2+ years of hands-on experience in software engineering.
• Strong understanding of security principles, software development, IAM, networking, and application security.
• Demonstrated ability to influence technical direction across teams and mentor other engineers.
• Strong problem-solving, communication, and documentation skills.
• Proven ability to collaborate with and influence cross-functional technical teams.
• DevOps methodologies and principles (CI/CD pipelines, Infrastructure as Code, GitOps)
• Vulnerability Management platforms (Qualys, Rapid7 InsightVM, Tenable)
• EDR platforms (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne)
• Compliance frameworks (PCI DSS, SOX, NIST, CIS 18)
• DLP solutions (Microsoft Purview, Symantec, Trellix)
• Large Language Models (LLMs) and prompt engineering applied to security workflows
• Extensive hands-on experience with:
• Microsoft security platforms (Sentinel, Defender, Entra ID, Purview)
• SIEM platforms (Microsoft Sentinel, Splunk, Rapid7) including detection engineering and analytics rule development
• Security automation (SOAR, CI/CD, IaC) and building automated response playbooks
• Python, REST APIs, and data formats (JSON, CSV, XML)
• Azure and AWS cloud environments, including cloud-native security controls
• Linux and Windows administration

Nice To Haves

• ISC(2): CISSP, CISM, CCSP
• AWS Certified: Security – Specialty, Solutions Architect Associate
• Microsoft Certified: Azure Security Engineer Associate, Identity and Access Administrator Associate, Security Operations Analyst Associate
• Cisco Certified: CCNA, CCNP
• HashiCorp Certified: Terraform Associate
• Offensive Security: OSCP, OSCE

Responsibilities

• Microsoft Security Ecosystem Integration: Partner with Identity and Endpoint teams to drive ≥ 90% coverage of Conditional Access and PIM enforcement. Guide the deployment strategy for Microsoft Defender capabilities to reach ≥ 95% of eligible assets. Oversee the architectural integration of Sentinel with core telemetry sources to enable high-fidelity detection and response coordination.
• SIEM, SOAR, and SecOps Effectiveness: Champion automation initiatives to reduce mean time to detect (MTTD) and respond (MTTR) by ≥ 30% through improved correlation and playbook design. Lead the design of SOAR workflows to automate ≥ 60% of repetitive tasks, partnering with SecOps for implementation. Drive the strategy for improving signal-to-noise ratio by guiding the tuning of detections based on threat trends.
• Hybrid Cloud Security Posture and Resilience: Define and guide the adoption of policy-as-code guardrails for cloud and on-premises infrastructure. Drive the strategy for hybrid telemetry integration and posture monitoring to enable faster risk identification. Partner with engineering and infrastructure teams to prioritize and track the remediation of high-risk misconfigurations and vulnerabilities.
• Technical Leadership and Security Influence: Champion the adoption of security engineering standards, reference architectures, and implementation patterns across teams. Represent security in architectural decision-making as a trusted technical authority, influencing major technology initiatives. Mentor engineers and elevate team capabilities through coaching, design reviews, and sharing operational best practices.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed