Senior Cybersecurity Analyst

AV; United States; Hybrid; USD 91,000 - 155,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) with company match

Flexible work schedule options

9/80 work schedule and paid holiday

Job summary

AeroVironment is seeking a Senior Cybersecurity Analyst to lead investigations, coordinate responses, and provide expert guidance across security teams. You will analyze diverse telemetry, develop timelines, and drive remediation efforts in a hybrid office environment.

The ideal candidate brings 5+ years in incident response, strong knowledge of SIEM/EDR, and proficiency in scripting to automate tasks. Collaboration with IT, legal, and business stakeholders is essential.

Qualifications

• 5+ years of experience in cybersecurity incident response, security operations, digital forensics, or related discipline.
• Experience leading investigations of complex security incidents including ransomware, phishing, account compromise, insider threats.
• Knowledge of incident response lifecycle and frameworks (NIST IRF, MITRE ATT&CK, Cyber Kill Chain).
• Experience with SIEM, EDR, network monitoring, vulnerability management, and forensic tools.
• Proficiency analyzing OS logs, auth logs, network traffic, endpoint telemetry, and cloud security events.
• Scripting/automation with PowerShell, Python, Bash.
• Ability to write clear incident reports and executive summaries.
• Willingness to participate in on-call rotation and handle high-severity incidents.
• Strong communication, analytical, and leadership skills.

Responsibilities

• Lead complex cybersecurity investigations from triage to containment, eradication, and closure with thorough documentation.
• Serve as primary technical lead for escalated security incidents across analysts and teams.
• Analyze telemetry to determine incident scope, attack vectors, assets affected, and business impact.
• Develop incident timelines, identify root causes, persistence, lateral movement, and IOC.
• Preserve and analyze digital evidence per evidence-handling and chain-of-custody procedures.
• Coordinate containment and remediation with IT, engineering, and business stakeholders.
• Investigate phishing, account compromise, malware, ransomware, data exfiltration, and insider threats.
• Use Microsoft Sentinel, Defender, and other platforms to correlate alerts and validate findings.
• Conduct threat hunting based on findings and threat intel.
• Maintain incident records and provide executive summaries and recommendations.
• Escalate significant incidents and coordinate with leadership, Legal, HR, Privacy, and Compliance.
• Lead post-incident reviews and track corrective actions.
• Develop and maintain playbooks, response procedures, and evidence collection guidance.
• Mentor analysts and improve detection and response through reviews and exercises.
• Participate in on-call rotation and after-hours response as required.

Skills

Endpoint forensics

Network forensics

SIEM

EDR

Threat hunting

Incident leadership

Security automation

PowerShell

Python

Bash

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

Microsoft Sentinel

Microsoft Defender

Security platforms

Job description

Worker Type

Regular

Job Description

Summary

The Senior Cybersecurity Analyst leads the investigation, containment, and remediation of cybersecurity incidents across the organization. This role serves as a technical escalation point for complex security events, coordinates response activities with IT, engineering, legal, and business stakeholders, and provides guidance to less-experienced analysts. The ideal candidate has strong expertise in endpoint and network forensics, SIEM and EDR technologies, threat hunting, incident leadership, and security automation.

Position Responsibilities

• Lead complex cybersecurity investigations from initial triage through containment, eradication, recovery, and closure, ensuring timely execution and thorough documentation.
• Serve as the primary technical lead for escalated security incidents, establishing investigation priorities, assigning tasks, and coordinating response activities across analysts and technical teams.
• Analyze endpoint, identity, email, network, and cloud telemetry to determine incident scope, attack vectors, affected assets, adversary activity, and potential business impact.
• Develop incident timelines and identify root causes, persistence mechanisms, lateral movement, and indicators of compromise.
• Collect, preserve, and analyze digital evidence in accordance with established evidence-handling, chain-of-custody, and retention procedures.
• Coordinate containment and remediation with IT, engineering, application owners, and business stakeholders, balancing incident urgency with operational requirements.
• Investigate phishing, account compromise, malware, ransomware, unauthorized access, data exfiltration, and suspected insider threats within approved investigative authority.
• Use Microsoft Sentinel, Microsoft Defender, and other security platforms to correlate alerts, develop investigative queries, and validate findings.
• Conduct threat hunting based on incident findings, threat intelligence, and adversary techniques to identify previously undetected activity.
• Maintain accurate incident records and provide clear technical findings, executive summaries, status updates, and actionable recommendations.
• Escalate significant incidents through established channels and coordinate with leadership, Legal, Human Resources, Privacy, and Compliance as appropriate.
• Lead post-incident reviews, identify control gaps, and track corrective actions through verified completion.
• Develop and maintain investigation playbooks, response procedures, escalation criteria, and evidence-collection guidance.
• Partner with security engineers to improve detection coverage, reduce false positives, and automate repeatable investigative and response tasks.
• Mentor analysts, review investigation quality, and strengthen team capabilities through case reviews, exercises, and knowledge sharing.
• Participate in the on-call rotation and lead after-hours response to critical security incidents as required.

Basic Qualifications (Required Skills & Experience)

• 5+ years of experience in cybersecurity incident response, security operations, digital forensics, or related discipline.
• Demonstrated experience leading the investigation and response of complex security incidents, including: Ransomware and malware, Phishing and business email compromise, Account compromise and credential theft, Insider threats, Data exfiltration, Unauthorized access and privilege escalation
• Strong knowledge of incident response processes, including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
• Experience using security technologies such as: SIEM platforms, Endpoint Detection and Response (EDR) tools, Network monitoring and intrusion detection systems, Vulnerability management platforms, Digital forensic and malware analysis tools
• Proficiency analyzing all Operating System logs, authentication logs, network traffic, endpoint telemetry, and cloud security events.
• Knowledge of common attack techniques and frameworks, including MITRE ATT&CK, the Cyber Kill Chain, and the NIST Incident Response Framework.
• Experience with scripting or automation using tools such as PowerShell, Python, Bash, or similar.
• Ability to write clear incident reports, technical findings, executive summaries, and after-action reports.
• Ability to participate in on-call rotation and respond effectively during high-severity incidents.
• Strong communication, analytical, decision-making, and incident leadership skills.
• Ability to maintain confidentiality and handle sensitive information appropriately.

Other Qualifications & Desired Competencies

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field or equivalent practical experience.
• Professional certifications such as: GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA), CISSP, Security+, Certified Ethical Hacker (CEH)
• Experience leading incident response activities across enterprise, manufacturing, aerospace, defense, or other regulated environments.
• Experience with cloud platforms such as Microsoft Azure, AWS, or Google Cloud.
• Experience investigating identity and access systems, including Active Directory, Entra ID, Okta, or similar platforms.
• Knowledge of security and privacy requirements such as NIST 800-61, NIST 800-53, ISO 27001, CMMC, ITAR, or FedRAMP, as applicable.
• Experience with threat hunting, malware triage, reverse engineering, memory and disk forensics.
• Experience developing incident response playbooks, detection logic, automation, and operational metrics.
• Prior experience mentoring junior analysts or coordinating cross-functional response teams.
• Active U.S. security clearance, or the ability to obtain and maintain one.

Physical Demands

• Ability to work in an office environment (Hybrid)
• Must be within 50 miles of an AV office location
• Required to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)

Clearance Level

Secret

Salary range for this role is:

$91,000 - $154,500

ITAR Requirement:

This position requires access to information that is subject to compliance with the International Traffic Arms Regulations (“ITAR”) and/or the Export Administration Regulations (“EAR”). In order to comply with the requirements of the ITAR and/or the EAR, applicants must qualify as a U.S. person under the ITAR and the EAR, or a person to be approved for an export license by the governing agency whose technology comes under its jurisdiction. Please understand that any job offer that requires approval of an export license will be conditional on AeroVironment’s determination that it will be able to obtain an export license in a time frame consistent with AeroVironment’s business requirements. A “U.S. person” according to the ITAR definition is a U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as a refugee or asylee. See 22 CFR § 120.15. Some positions will require current U.S. Citizenship due to contract requirements.

Benefits

• medical
• dental
• vision
• 401(k) with company matching
• flexible work schedule options
• select programs may offer a 9/80 work schedule and paid holiday shutdown

We also encourage you to review our company website at http://www.avinc.com to learn more about us.

About AV:

AV isn’t for everyone. We hire the curious, the relentless, the mission-obsessed. The best of the best.

We don’t just build defense technology—we redefine what’s possible. As the premier autonomous systems company in the U.S., AV delivers breakthrough capabilities across air, land, sea, space, and cyber. From AI-powered drones and loitering munitions to integrated autonomy and space resilience, our technologies shape the future of warfare and protect those who serve.

Founded by legendary innovator Dr. Paul MacCready, AV has spent over 50 years pushing the boundaries of what unmanned systems can do. Our heritage includes seven platforms in the Smithsonian—but we’re not building history, we’re building what’s next.

If you're ready to build technology that matters—with speed, scale, and purpose—there’s no better place to do it than AV.

We are proud to be an EEO/AA Equal Opportunity Employer, including disability/veterans. AeroVironment, Inc. is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Qualified applicants will receive fair and impartial consideration without regard to race, sex, color, religion, national origin, age, disability, protected veteran status, genetic data,sexual orientation, gender identity or other legally protected status.

ITAR

U.S. Citizenship required