Cybersecurity Engineer - Incident Response

What you’ll do

In this role, you will investigate and respond to cybersecurity incidents while engineering improvements to the organization’s incident response capabilities. The work blends hands-on technical investigation with engineering detections, response workflows, and security platform configuration using Microsoft security technologies.

• Investigate and respond to security incidents across endpoints, identities, email, cloud services, and enterprise infrastructure.
• Scope incidents, reconstruct timelines, perform root cause analysis, and assess impact using available telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to increase visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Create and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews, document lessons learned, and track corrective actions to completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports covering findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.
• Preserve investigation evidence and maintain accurate records in accordance with organizational requirements.
• Measure incident response effectiveness using metrics such as detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
• Support incident response coverage, including participation in an established on-call rotation as required.

Required experience and skills

• 3+ years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python to support investigation, data analysis, and automation.
• Demonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.
• Strong technical writing and communication skills for technical and nontechnical audiences.
• Ability to remain organized, exercise sound judgment, and coordinate response activities under pressure.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field (or equivalent practical experience).

Preferred qualifications

• Experience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, or Microsoft Purview.
• Experience supporting Azure Government, Microsoft GCC High, or other regulated environments.
• Familiarity with MITRE ATT&CK and using adversary techniques to guide investigations and improve detections.
• Experience with digital forensics, malware triage, or business email compromise investigations.
• Experience building response workflows using Azure Logic Apps, Azure Functions, or comparable orchestration tools.
• Familiarity with CMMC and NIST SP 800-171 incident response and audit evidence requirements.
• Relevant Microsoft security certifications such as Microsoft Certified: Security Operations Analyst Associate (or comparable demonstrated expertise).

Technologies

• Microsoft Sentinel
• Microsoft Defender XDR
• Defender for Endpoint
• Defender for Office 365
• Microsoft Entra ID
• Kusto Query Language (KQL)
• PowerShell
• Python
• Microsoft Defender for Identity
• Defender for Cloud Apps
• Defender for Cloud
• Microsoft Intune
• Microsoft Purview
• Azure Logic Apps
• Azure Functions
• MITRE ATT&CK

Clearance and ITAR

• Clearance level: Secret
• ITAR requirement: U.S. person eligibility is required for this position. U.S. citizens, U.S. lawful permanent residents (green card holders), or protected individuals (such as refugees or asylees) qualify under the ITAR definition. Applicants must also qualify as a U.S. person under the ITAR and EAR, or be approved for an export license by the governing agency whose technology comes under its jurisdiction.
• ITAR note: U.S. Citizenship required.