Cybersecurity Engineer - Incident Response

Join AeroVironment in Huntsville, AL onsite to investigate and respond to cybersecurity incidents while strengthening Microsoft-based detection and response capabilities.

Responsibilities

• Investigate and respond to security incidents across endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to increase visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address investigation-identified gaps.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews, document lessons learned, and track corrective actions to completion.
• Identify recurring incident patterns and implement engineering changes to address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce incident reports covering findings, business impact, response actions, and recommended improvements.
• Run tabletop exercises and technical response drills to validate procedures and improve readiness.
• Preserve investigation evidence and maintain accurate records per organizational requirements.
• Measure incident response effectiveness using detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
• Support incident response coverage, including participation in an established on-call rotation as required.

Requirements

• 3+ years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on incident investigation and response experience in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and ability to apply structured investigation, containment, eradication, and recovery.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python to support investigation, data analysis, and automation of repetitive tasks.
• Demonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.
• Strong technical writing and communication skills for explaining incident findings to both technical and nontechnical audiences.
• Ability to stay organized, exercise sound judgment, and coordinate response activities under pressure.
• Bachelor’s degree in cybersecurity, computer science, information technology, or related field, or equivalent practical experience.

Technologies

• Microsoft Sentinel
• Microsoft Defender XDR
• Defender for Endpoint
• Defender for Office 365
• Microsoft Entra ID
• Kusto Query Language (KQL)
• PowerShell
• Python
• Microsoft Defender for Identity
• Defender for Cloud Apps
• Defender for Cloud
• Microsoft Intune
• Microsoft Purview
• Azure Logic Apps
• Azure Functions
• MITRE ATT&CK

Benefits

• Medical, dental, vision
• 401K with company matching
• 9/80 work schedule
• Paid holiday shutdown

Other Qualifications & Desired Competencies

• Experience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, or Microsoft Purview.
• Experience supporting Azure Government, Microsoft GCC High, or other regulated environments.
• Familiarity with MITRE ATT&CK and using adversary techniques to guide investigations and improve detections.
• Experience with digital forensics, malware triage, or business email compromise investigations.
• Experience building response workflows using Azure Logic Apps, Azure Functions, or comparable orchestration tools.
• Familiarity with CMMC and NIST SP 800-171 incident response and audit evidence requirements.
• Relevant Microsoft security certifications, such as Microsoft Certified: Security Operations Analyst Associate, or comparable demonstrated expertise.

Physical Demands

• Ability to work in an office environment (Constant)
• Required to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)

Clearance Level

• Secret

ITAR Requirement

• U.S. Citizenship required.
• Role requires access to information subject to compliance with ITAR and/or EAR.
• Applicants must qualify as a U.S. person under ITAR and EAR, or be a person approved for an export license by the governing agency whose technology comes under its jurisdiction.
• U.S. person (ITAR definition): U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as a refugee or asylee.