Security Incident Response Engineer

AV; Huntsville (AL); On-site; USD 112,000 - 170,000; Full time

Benefits offered by this job

Medical benefits

401K with company matching

9/80 work schedule

Paid holiday shutdown

Job summary

AV is seeking a Cybersecurity Engineer to investigate and respond to security incidents across endpoints, identities, email, cloud services, and enterprise infrastructure. You will perform root cause analysis, coordinate containment and recovery, and develop detections and playbooks to strengthen incident response capabilities.

The role requires hands-on experience with Microsoft Sentinel, Defender XDR, and Defender for Endpoint, plus proficiency with KQL, PowerShell or Python, and strong

Qualifications

• Three or more years of experience in cybersecurity engineering, incident response, security operations, or related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Defender for Endpoint, and Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Entra ID, Office 365, and Azure.
• Understanding of incident response frameworks and structured investigation, containment, eradication, and recovery practices.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python for investigation support and automation.
• Demonstrated ability to improve incident response procedures and detections.
• Strong technical writing and communication skills.

Responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, and Entra ID to investigate threats and support response actions.
• Develop and tune KQL queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews, document lessons learned, and track corrective actions through completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports that document findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.
• Preserve investigation evidence and maintain accurate records in accordance with organizational requirements.
• Measure incident response effectiveness through detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
• Support incident response coverage, including participation in an on-call rotation.

Skills

Cybersecurity engineering

Microsoft Sentinel

KQL

Windows security

Active Directory

Entra ID

Microsoft 365

Azure

PowerShell

Python

incident response

technical writing

Education

Bachelor's degree

Tools

Microsoft Sentinel

Defender for Endpoint

Defender XDR

Job description

AV is seeking a Cybersecurity Engineer to investigate and respond to security incidents across endpoints, identities, email, cloud services, and enterprise infrastructure. You will perform root cause analysis, coordinate containment and recovery, and develop detections and playbooks to strengthen incident response capabilities.

The role requires hands-on experience with Microsoft Sentinel, Defender XDR, and Defender for Endpoint, plus proficiency with KQL, PowerShell or Python, and strong