Cybersecurity Incident Response Engineer — Secret Clearance

VulnU; Huntsville (AL); On-site; USD 112,000 - 170,000; Full time

Job summary

BlueHalo in Huntsville, AL is seeking a Cybersecurity Engineer specialized in incident response to enhance the organization’s incident response capabilities. You will investigate incidents across endpoints, identities, email, cloud services, and enterprise infrastructure, while developing detections and response workflows.

The role requires hands-on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, and Entra ID, plus strong KQL skills.

Qualifications

• Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python for investigation support, data analysis, and repetitive task automation.
• Demonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.
• Strong technical writing and communication skills, including the ability to explain incident findings to technical and nontechnical audiences.

Responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, and Entra ID to investigate threats and support response actions.
• Develop and tune KQL queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews and track corrective actions through completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports documenting findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.

Skills

Cybersecurity engineering

Incident response

Security operations

Kusto Query Language (KQL)

Windows security

Active Directory

Microsoft Defender XDR

Microsoft Defender for Endpoint

Education

Bachelor's degree in cybersecurity, computer science, information technology, or related field

Tools

Microsoft Sentinel

Microsoft Defender for Endpoint

Microsoft Defender XDR

Defender for Office 365

Microsoft Entra ID

Azure

PowerShell

Python

KQL

Job description

BlueHalo in Huntsville, AL is seeking a Cybersecurity Engineer specialized in incident response to enhance the organization’s incident response capabilities. You will investigate incidents across endpoints, identities, email, cloud services, and enterprise infrastructure, while developing detections and response workflows.

The role requires hands-on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, and Entra ID, plus strong KQL skills.