Cybersecurity Engineer - Incident Response
AeroVironment, Inc.17 days ago
Huntsville, AL, USA or Dayton, OH, USAMid Level
Base Salary
$112k - $170k/yr
Responsibilities
- Investigate and respond to cybersecurity incidents across endpoints, identities, email, cloud services, and enterprise infrastructure.
- Perform incident scoping, timeline reconstruction, root cause analysis, impact assessment, evidence preservation, and incident documentation.
- Coordinate containment, eradication, recovery, and corrective actions with system owners while minimizing business disruption.
- Develop and tune KQL queries, analytics rules, detections, and threat-hunting queries.
- Improve security logging, data collection, platform integrations, response workflows, playbooks, runbooks, and escalation procedures.
- Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
- Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
- Lead or support post-incident reviews, tabletop exercises, technical response drills, and incident response effectiveness measurement.
- Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
- Produce clear reports describing findings, business impact, response actions, and recommended improvements.
- Participate in established on-call incident response coverage as required.
Requirements
- At least 3 years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
- Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
- Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
- Proficiency with KQL for log analysis, threat hunting, and detection development.
- Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
- Understanding of structured incident response practices covering investigation, containment, eradication, and recovery.
- Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
- Familiarity with PowerShell or Python for investigation support, data analysis, and task automation.
- Demonstrated ability to improve response procedures, detection coverage, or security platform configurations.
- Strong technical writing, communication, organization, judgment, and coordination skills.
- Bachelor's degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience.
- Preferred experience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, Microsoft Purview, Azure Government, Microsoft GCC High, or other regulated environments.
- Preferred familiarity with MITRE ATT&CK, digital forensics, malware triage, business email compromise investigations, Azure orchestration tools, CMMC, and NIST SP 800-171.
- Relevant Microsoft security certifications or comparable demonstrated expertise.
- Ability to meet Secret clearance and ITAR/EAR U.S.-person or export-license requirements; some positions require current U.S. citizenship.
Benefits
- Medical, dental, and vision benefits.
- 401(k) with company matching.
- 9/80 work schedule.
- Paid holiday shutdown.
- Regular full-time position with office-based physical demands and required participation in an on-call rotation.
- Secret clearance and ITAR/EAR eligibility requirements apply.
About AeroVironment, Inc.
AeroVironment builds small unmanned aircraft systems, loitering munitions (e.g., Switchblade), and related software, sensors, and services for U.S. and allied defense agencies. The public company (NASDAQ: AVAV), founded in 1971 and headquartered in Arlington, Virginia, sells hardware, training, and lifecycle support, with widely fielded systems such as Raven, Puma, and Wasp. It also offers autonomy and robotic technologies used in reconnaissance, targeting, and force protection missions.