{"id":3310615,"url":"https://alion.io/job/aerovironment-cybersecurity-engineer-incident-response","title":"Cybersecurity Engineer - Incident Response","company":{"id":176366,"name":"AeroVironment","domain":"avinc.com","url":"https://alion.io/company/aerovironment","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":83,"open_postings":26,"ghost_share":0,"stale_share":0.692,"repost_share":0,"time_to_fill_p50_days":36,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Huntsville, United States","Dayton, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":111500,"max":170000,"currency":"USD","period":"year","gross":null,"usd_annual":170000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"CMMC","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-26T00:00:00Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-31T05:03:12Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Worker Type\nRegularJob Description\nSummary\nThe Cybersecurity Engineer investigates and responds to cybersecurity incidents while engineering improvements to the organization's incident response capabilities. This role combines hands-on technical investigation with the development of detections, response workflows, and security platform configurations that help the organization identify, contain, and recover from threats.\nThe ideal candidate has a strong background in Microsoft security technologies, experience supporting security operations, and the ability to turn lessons learned from incidents into measurable improvements. This position requires sound technical judgment, clear communication, and close collaboration with security analysts, IT teams, and business stakeholders.\nPosition Responsibilities\nInvestigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.\nPerform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using available telemetry and forensic evidence.\nCoordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.\nUse Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.\nDevelop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.\nImprove security logging, data collection, and platform integrations to address gaps identified during investigations.\nDevelop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.\nLead or support post-incident reviews, document lessons learned, and track corrective actions through completion.\nIdentify recurring incident patterns and implement engineering changes that address underlying weaknesses.\nPartner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.\nProduce clear incident reports that document findings, business impact, response actions, and recommended improvements.\nConduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.\nPreserve investigation evidence and maintain accurate records in accordance with organizational requirements.\nMeasure incident response effectiveness through detection and containment times, repeat incidents, playbook coverage, and corrective action completion.\nSupport incident response coverage, including participation in an established on-call rotation as required.\nBasic Qualifications (Required Skills & Experience)\nThree or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.\nHands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.\nExperience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.\nProficiency with KQL for log analysis, threat hunting, and detection development.\nWorking knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.\nUnderstanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.\nExperience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.\nFamiliarity with PowerShell or Python for investigation support, data analysis, and repetitive task automation.\nDemonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.\nStrong technical writing and communication skills, including the ability to explain incident findings to technical and nontechnical audiences.\nAbility to remain organized, exercise sound judgment, and coordinate response activities under pressure.\nBachelor's degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience.\nOther Qualifications & Desired Competencies\nExperience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, or Microsoft Purview.\nExperience supporting Azure Government, Microsoft GCC High, or other regulated environments.\nFamiliarity with MITRE ATT&CK and using adversary techniques to guide investigations and improve detections.\nExperience with digital forensics, malware triage, or business email compromise investigations.\nExperience building response workflows using Azure Logic Apps, Azure Functions, or comparable orchestration tools.\nFamiliarity with CMMC and NIST SP 800-171 incident response and audit evidence requirements.\nRelevant Microsoft security certifications, such as Microsoft Certified: Security Operations Analyst Associate, or comparable demonstrated expertise.\nSuccess in This Role\nSuccess is demonstrated through effective incident handling, clear and actionable reporting, stronger Microsoft security detections, and sustained improvements to response processes. The engineer helps the organization contain threats faster, reduce recurring incidents, and maintain consistent, repeatable response practices.\nPhysical Demands\nAbility to work in an office environment (Constant)\nRequired to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)\nClearance Level\nSecretThe salary range for this role is:\n$111,500 - $170,000AeroVironment considers several factors when extending an offer, including but not limited to, the location, the role and associated responsibilities, a candidate’s work experience, education/training, and key skills.\nITAR Requirement:\nThis position requires access to information that is subject to compliance with the International Traffic Arms Regulations (“ITAR”) and/or the Export Administration Regulations (“EAR”). In order to comply with the requirements of the ITAR and/or the EAR, applicants must qualify as a U.S. person under the ITAR and the EAR, or a person to be approved for an export license by the governing agency whose technology comes under its jurisdiction. Please understand that any job offer that requires approval of an export license will be conditional on AeroVironment’s determination that it will be able to obtain an export license in a time frame consistent with AeroVironment’s business requirements. A “U.S. person” according to the ITAR definition is a U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as a refugee or asylee. See 22 CFR § 120.15. Some positions will require current U.S. Citizenship due to contract requirements.\nBenefits: AV offers an excellent benefits package including medical, dental vision, 401K with company matching, a 9/80 work schedule and a paid holiday shutdown. For more information about our company benefit offerings please visit: http://www.avinc.com/myavbenefits.\nWe also encourage you to review our company website at http://www.avinc.com to learn more about us.\nPrincipals only need apply. NO agencies please.\nAbout AV:\nAV isn’t for everyone. We hire the curious, the relentless, the mission-obsessed. The best of the best.\nWe don’t just build defense technology-we redefine what’s possible. As the premier autonomous systems company in the U.S., AV delivers breakthrough capabilities across air, land, sea, space, and cyber. From AI-powered drones and loitering munitions to integrated autonomy and space resilience, our technologies shape the future of warfare and protect those who serve.\nFounded by legendary innovator Dr. Paul MacCready, AV has spent over 50 years pushing the boundaries of what unmanned systems can do. Our heritage includes seven platforms in the Smithsonian-but we’re not building history, we’re building what’s next.\nIf you're ready to build technology that matters-with speed, scale, and purpose-there’s no better place to do it than AV.\nWe are proud to be an EEO/AA Equal Opportunity Employer, including disability/veterans. AeroVironment, Inc. is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Qualified applicants will receive fair and impartial consideration without regard to race, sex, color, religion, national origin, age, disability, protected veteran status, genetic data, sexual orientation, gender identity or other legally protected status.\nITAR\nU.S. Citizenship required","description_format":"text","description_chars":8633,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["401k plan"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Military"],"lifecycle":[{"event":"open","at":"2026-10-27T03:11:02Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":5,"expected_fill_days":36,"reasons":["conf:0","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":{"stated_usd_annual":170000,"is_top_pay":true},"html_url":"https://alion.io/job/aerovironment-cybersecurity-engineer-incident-response","json_url":"https://alion.io/job/aerovironment-cybersecurity-engineer-incident-response.json","meta":{"generated_at":"2026-10-31T13:16:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20567,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":176366},"rest":"https://alion.io/mcp/rest/get_company?id=176366"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faerovironment-cybersecurity-engineer-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faerovironment-cybersecurity-engineer-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faerovironment-cybersecurity-engineer-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aerovironment-cybersecurity-engineer-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faerovironment-cybersecurity-engineer-incident-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3310615}},{"tool":"search_jobs","arguments":{"company":"avinc.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3310615},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}