Cybersecurity Incident Response Engineer — Microsoft Defender Expert

AeroVironment, Inc.; Huntsville (AL); On-site; USD 112,000 - 170,000; Full time

Benefits offered by this job

Medical benefits

401K with company matching

9/80 work schedule

Paid holidays

Job summary

AeroVironment, Inc. in Huntsville, AL is seeking a Cybersecurity Engineer to investigate and respond to incidents while strengthening incident response capabilities.

The role blends hands-on investigation with developing detections, response workflows, and security configurations to identify, contain, and recover from threats. The ideal candidate will have a strong background in Microsoft security technologies, experience in security operations, and the ability to translate lessons learned into

Qualifications

• Three or more years in cybersecurity engineering or related role.
• Hands-on experience investigating and responding to incidents in Microsoft-based environments.
• Experience with Microsoft Sentinel, Defender for Endpoint, and Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Strong written and verbal communication skills for technical and non-technical audiences.
• Bachelor's degree in cybersecurity, computer science, information technology, or related field, or equivalent practical experience.

Responsibilities

• Investigate and respond to security incidents across endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Defender for Endpoint, Defender XDR, Defender for Office 365, and Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post‑incident reviews, document lessons learned, and track corrective actions through completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports that document findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.

Skills

Incident response

KQL

Defender XDR

Microsoft Sentinel

PowerShell

Python

Education

Bachelor's degree in cybersecurity, computer science, information technology, or related field

Tools

PowerShell

Python

KQL

Job description

AeroVironment, Inc. in Huntsville, AL is seeking a Cybersecurity Engineer to investigate and respond to incidents while strengthening incident response capabilities.

The role blends hands-on investigation with developing detections, response workflows, and security configurations to identify, contain, and recover from threats. The ideal candidate will have a strong background in Microsoft security technologies, experience in security operations, and the ability to translate lessons learned into