Incident Response Security Engineer (Microsoft Defender)

AeroVironment, Inc.; Dayton (OH); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, dental, vision

401K with company matching

9/80 work schedule

Paid holiday shutdown

Job summary

Aeros AeroVironment, Inc. in Dayton, OH is seeking a Cybersecurity Engineer to investigate incidents, develop detections, and tune security workflows.

The role requires strong Microsoft security expertise and collaboration with security analysts, IT teams, and stakeholders. The ideal candidate will drive improvements to incident response capabilities, logs, and platform configurations, while contributing to post-incident reviews and playbooks.

Qualifications

• Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Defender for Endpoint, and Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and structured investigation, containment, eradication, and recovery practices.
• Experience analyzing telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python for investigation support and automation.
• Demonstrated ability to improve incident response procedures, detections, or security configurations.
• Strong technical writing and communication skills.
• Ability to stay organized and coordinate response under pressure.
• Bachelor's degree in cybersecurity, computer science, information technology, or related field, or equivalent experience.

Responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments.
• Coordinate containment, eradication, and recovery activities with system owners.
• Use Microsoft tools to investigate threats and support response actions.
• Develop and tune KQL queries, analytics rules, detections, and hunting queries.
• Improve security logging, data collection, and platform integrations.
• Develop and maintain incident response plans, playbooks, and escalation procedures.
• Lead or support post-incident reviews and track corrective actions.
• Identify recurring incident patterns and address weaknesses with engineering changes.
• Partner with automation engineers to streamline alert enrichment and case management.
• Produce clear incident reports documenting findings and impact.
• Conduct tabletop exercises to validate procedures and strengthen readiness.
• Preserve investigation evidence and maintain records per requirements.
• Measure incident response effectiveness through metrics and improvements.
• Support incident response coverage, including on-call rotation.

Skills

Cybersecurity engineering

Incident response

Security operations

Microsoft Sentinel

Microsoft Defender for Endpoint

Microsoft Defender XDR

KQL

Windows security

Active Directory

Microsoft Entra ID

Microsoft 365

Azure

Incident response frameworks

PowerShell

Python

Technical writing

Education

Bachelor's degree in cybersecurity or related field

Tools

Microsoft Sentinel

Microsoft Defender for Endpoint

Microsoft Defender XDR

PowerShell

Python

Kusto Query Language (KQL)

Job description

Aeros AeroVironment, Inc. in Dayton, OH is seeking a Cybersecurity Engineer to investigate incidents, develop detections, and tune security workflows.

The role requires strong Microsoft security expertise and collaboration with security analysts, IT teams, and stakeholders. The ideal candidate will drive improvements to incident response capabilities, logs, and platform configurations, while contributing to post-incident reviews and playbooks.