Cybersecurity Engineer - Incident Response

Job description

Job responsibilities

• Investigate and respond to security incidents involving endpoints, identities, email, cloud services, and enterprise infrastructure.
• Perform incident scoping, timeline reconstruction, root cause analysis, and impact assessments using available telemetry and forensic evidence.
• Coordinate containment, eradication, and recovery activities with system owners while minimizing business disruption.
• Use Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Microsoft Entra ID to investigate threats and support response actions.
• Develop and tune Kusto Query Language (KQL) queries, analytics rules, detections, and hunting queries to improve threat visibility and reduce false positives.
• Improve security logging, data collection, and platform integrations to address gaps identified during investigations.
• Develop and maintain incident response plans, playbooks, runbooks, escalation procedures, and incident classification criteria.
• Lead or support post-incident reviews, document lessons learned, and track corrective actions through completion.

Job requirements

• Three or more years of experience in cybersecurity engineering, incident response, security operations, or a related technical role.
• Hands-on experience investigating and responding to incidents in Microsoft-based enterprise environments.
• Experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and Microsoft Defender XDR.
• Proficiency with KQL for log analysis, threat hunting, and detection development.
• Working knowledge of Windows security, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure.
• Understanding of incident response frameworks and the ability to apply structured investigation, containment, eradication, and recovery practices.
• Experience analyzing endpoint, identity, email, and network telemetry to identify malicious activity and determine incident scope.
• Familiarity with PowerShell or Python for investigation support, data analysis, and repetitive task automation.