Cybersecurity Incident Response Specialist

AV; Dayton (OH); On-site; USD 112,000 - 170,000; Full time

Benefits offered by this job

Medical, dental, vision

401K with company matching

9/80 work schedule

Paid holiday shutdown

Job summary

AV is seeking a Cybersecurity Engineer to investigate and respond to incidents while enhancing incident response capabilities. The role blends hands-on analysis with developing detections, response playbooks, and security platform configurations across endpoints, identities, email, cloud, and enterprise infrastructure.

You will use Microsoft Sentinel, Defender XDR, and Defender for Endpoint to investigate threats, build KQL queries, and tune detections.

Qualifications

• 3+ years in cybersecurity engineering or related role.
• Hands-on experience investigating and responding to incidents in Microsoft-based environments.
• Experience with Microsoft Sentinel, Defender for Endpoint, and Defender XDR.
• Proficiency with KQL for log analysis and threat hunting.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and containment/recovery practices.
• Experience analyzing telemetry to identify malicious activity.
• Proficiency in PowerShell or Python for investigation.
• Ability to explain findings to technical and non-technical audiences.

Responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using available telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post‑incident reviews, document lessons learned, and track corrective actions through completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports that document findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.
• Preserve investigation evidence and maintain accurate records in accordance with organizational requirements.
• Measure incident response effectiveness through detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
• Support incident response coverage, including participation in an established on‑call rotation as required.

Skills

Incident response

Microsoft Sentinel

Microsoft Defender for Endpoint

Microsoft Defender XDR

KQL

Windows security

Active Directory

Azure

PowerShell or Python

Technical writing

Education

Bachelor's degree in cybersecurity or related field

Tools

PowerShell

Python

Azure

Job description

AV is seeking a Cybersecurity Engineer to investigate and respond to incidents while enhancing incident response capabilities. The role blends hands-on analysis with developing detections, response playbooks, and security platform configurations across endpoints, identities, email, cloud, and enterprise infrastructure.

You will use Microsoft Sentinel, Defender XDR, and Defender for Endpoint to investigate threats, build KQL queries, and tune detections.