Cybersecurity Engineer – Incident Response

AeroVironment

. Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure .

Posted 10/26/2026full-timeUnited StatesMid-LevelSenior💰 $111,500 - $170,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response and cybersecurity engineering, with proficiency in Microsoft security tools and KQL for threat detection and analysis. Capable of developing incident response plans and improving security procedures while effectively communicating findings and coordinating response activities.

Highest-signal resume keywords

Incident ResponseMicrosoft SentinelKQL ProficiencyCybersecurity EngineeringMicrosoft Defender for Endpoint

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ScopingRoot Cause AnalysisImpact AssessmentThreat HuntingData CollectionSecurity LoggingWindows SecurityActive DirectoryPowerShellPython

Soft Skills

Technical WritingCommunicationOrganizational SkillsJudgment Under Pressure

Tools & Technologies

Microsoft Defender XDRDefender for Office 365Microsoft Entra IDAzure

Certifications & Qualifications

Microsoft Security CertificationsDigital ForensicsCMMCNIST SP 800-171

Industry Keywords

CybersecurityIncident Response FrameworksMITRE ATT&CKRegulated EnvironmentExport License Eligibility

Tech Stack

Tools & technologies

AzureCloudCyber SecurityPython

About the role

Key responsibilities & impact

Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure
Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments
Coordinate containment, eradication, and recovery with system owners
Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats
Develop and tune KQL queries, analytics rules, detections, and hunting queries
Improve security logging, data collection, and platform integrations
Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria
Lead or support post-incident reviews, document lessons learned, and track corrective actions
Identify recurring incident patterns and implement engineering changes
Partner with automation engineers on alert enrichment, evidence collection, case management, and containment actions
Produce incident reports documenting findings, business impact, response actions, and recommendations
Conduct tabletop exercises and technical response drills
Preserve investigation evidence and maintain accurate records
Measure incident response effectiveness using detection and containment times, repeat incidents, playbook coverage, and corrective action completion
Participate in an established on-call rotation as required

Requirements

What you’ll need

Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role
Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments
Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR
Proficiency with KQL for log analysis, threat hunting, and detection development
Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure
Understanding of incident response frameworks and structured investigation, containment, eradication, and recovery practices
Experience analyzing endpoint, identity, email, and network telemetry
Familiarity with PowerShell or Python
Ability to improve incident response procedures, detection coverage, or security platform configurations
Strong technical writing and communication skills
Ability to remain organized, exercise sound judgment, and coordinate response activities under pressure
Bachelor's degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience
Secret clearance
U.S. person status or eligibility for an export license under ITAR/EAR; some positions require current U.S. citizenship
Ability to work in an office environment
Relevant Microsoft security certifications, digital forensics, MITRE ATT&CK, regulated-environment, orchestration, CMMC, and NIST SP 800-171 experience are desired competencies

Benefits

Comp & perks

Medical, dental, and vision benefits
401(k) with company matching
9/80 work schedule
Paid holiday shutdown