Job Requirements
Remote Huntsville, AL
Secret Polygraph None
Career Level not specified
Salary not specified
Join Premium to unlock estimated salaries 
Job Description
Our client is currently seeking a Cybersecurity Engineer - Incident Response
**This is a hybrid position and will be 2 days a week on-site out of Dayton, OH or Huntsville, AL
**This is a direct-hire position
**An active Secret or Top Secret clearance is required
**An active CompTIA Security + is required
This job will have the following responsibilities:
Qualifications & Requirements:
**This is a hybrid position and will be 2 days a week on-site out of Dayton, OH or Huntsville, AL
**This is a direct-hire position
**An active Secret or Top Secret clearance is required
**An active CompTIA Security + is required
This job will have the following responsibilities:
- Position Responsibilities
- Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
- Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using available telemetry and forensic evidence.
- Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
- Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
- Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
- Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
- Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
- Lead or support post-incident reviews, document lessons learned, and track corrective actions through completion.
- Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
- Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
- Produce clear incident reports that document findings, business impact, response actions, and recommended improvements.
- Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.
- Preserve investigation evidence and maintain accurate records in accordance with organizational requirements.
- Measure incident response effectiveness through detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
- Support incident response coverage, including participation in an established on-call rotation as required.
Qualifications & Requirements:
- Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
- Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
- Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
- Proficiency with KQL for log analysis, threat hunting, and detection development.
- Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
- Understanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.
- Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
- Familiarity with PowerShell or Python for investigation support, data analysis, and repetitive task automation.
- Demonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.
- Strong technical writing and communication skills, including the ability to explain incident findings to technical and nontechnical audiences.
- Ability to remain organized, exercise sound judgment, and coordinate response activities under pressure.
- Bachelor's degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience.
Other Qualifications & Desired Competencies
- Experience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, or Microsoft Purview.
- Experience supporting Azure Government, Microsoft GCC High, or other regulated environments.
- Familiarity with MITRE ATT&CK and using adversary techniques to guide investigations and improve detections.
- Experience with digital forensics, malware triage, or business email compromise investigations.
- Experience building response workflows using Azure Logic Apps, Azure Functions, or comparable orchestration tools.
- Familiarity with CMMC and NIST SP 800-171 incident response and audit evidence requirements.
- Relevant Microsoft security certifications, such as Microsoft Certified: Security Operations Analyst Associate, or comparable demonstrated expertise.
group id: cxjudgpa
