Cybersecurity Engineer - Incident Response with Security Clearance

Our client is currently seeking a Cybersecurity Engineer - Incident Response **This is a hybrid position and will be 2 days a week on-site out of Dayton, OH or Huntsville, AL **This is a direct-hire position **An active Secret or Top Secret clearance is required **An active CompTIA Security + is required This job will have the following responsibilities:

*

Position Responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using available telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews, document lessons learned, and track corrective actions through completion.
• Identify recurring incident patterns and implement engineering changes that address underlying weaknesses.
• Partner with automation engineers to streamline alert enrichment, evidence collection, case management, and approved containment actions.
• Produce clear incident reports that document findings, business impact, response actions, and recommended improvements.
• Conduct tabletop exercises and technical response drills to validate procedures and strengthen team readiness.
• Preserve investigation evidence and maintain accurate records in accordance with organizational requirements.
• Measure incident response effectiveness through detection and containment times, repeat incidents, playbook coverage, and corrective action completion.
• Support incident response coverage, including participation in an established on-call rotation as required. Qualifications & Requirements: *
• Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python for investigation support, data analysis, and repetitive task automation.
• Demonstrated ability to improve incident response procedures, detection coverage, or security platform configurations.
• Strong technical writing and communication skills, including the ability to explain incident findings to technical and nontechnical audiences.
• Ability to remain organized, exercise sound judgment, and coordinate response activities under pressure.
• Bachelor's degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience. Other Qualifications & Desired Competencies
• Experience with Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Intune, or Microsoft Purview.
• Experience supporting Azure Government, Microsoft GCC High, or other regulated environments.
• Familiarity with MITRE ATT&CK and using adversary techniques to guide investigations and improve detections.
• Experience with digital forensics, malware triage, or business email compromise investigations.
• Experience building response workflows using Azure Logic Apps, Azure Functions, or comparable orchestration tools.
• Familiarity with CMMC and NIST SP 800-171 incident response and audit evidence requirements.
• Relevant Microsoft security certifications, such as Microsoft Certified: Security Operations Analyst Associate, or comparable demonstrated expertise.