> Markdown version of [/jobs/ext/4657861-defensive-cybersecurity-engineer-incident-response](https://www.wearedevelopers.com/jobs/ext/4657861-defensive-cybersecurity-engineer-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Defensive Cybersecurity Engineer/Incident Response

- **Company:** MITRE Corporation
- **Location:** Huntsville, AL, United States
- **Experience:** Starter
- **Salary:** $158,800 - $198,500
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing Security, Cyber Security, Network Topologies, Machine Learning, Security Information and Event Management, Mitre Att&ck, Generative AI, Cyber Threat Analysis, Information Technology, Splunk, Security Orchestration, Automation & Response
- **Published:** November 10, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9301400/defensive-cybersecurity-engineerincident-response

## About the Role

* Typically requires a minimum of 8 years of related experience with a Bachelor's degree; or 6 years and a Master's degree; or a PhD with 3 years' experience; or equivalent combination of related education and work experience. Must have a minimum of 3 years of operational experience.

 * Bachelor's degree in Computer Science, Cybersecurity, Data Science, Applied Mathematics, Statistics, or a related field

 * Knowledge of incident response operations, principles, and their application.
 * Demonstrated knowledge of and hands-on experience with generative AI or AI-enabled technologies, with the ability to apply these capabilities to cybersecurity investigation, incident response, threat analysis, or security automation.
 * Experience developing technical training content, curriculum, courseware, or other learning materials for cybersecurity audiences.
 * Strong technical writing, presentation, and facilitation skills.
 * Ability and willingness to travel up to 25% to deliver training at customer locations, including international locations.
 * Must be eligible to obtain and maintain a Top Secret U.S Government issued Security Clearance. Per the U.S. Government's eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.
 * This position requires a minimum of 3 days per week on-site.

Preferred Qualifications:

 * Comfort presenting to non-English-speaking audiences with translation support.
 * Experience applying MITRE ATT&CK to support cybersecurity operations
 * Experience leading incident response efforts and teams within a security operations center, incident response organization, or fly-away team.
 * Experience developing incident response playbooks, tabletop exercises, or operational training scenarios.
 * Experience leading technical training sessions for government, partner, or other technical audiences.
 * Experience creating hands-on cybersecurity labs, exercises, or scenario-based learning materials.
 * Experience with Splunk or Elastic/ELK.
 * Experience integrating AI-enabled workflows with cybersecurity platforms such as SIEM, SOAR, EDR/XDR, threat-intelligence, case-management, or cloud-security platforms.

## Description

* Provide subject matter expertise to government sponsors on enterprise security operations centers (SOCs), including daily operations, governance, and process improvement.
 * Translate complex defensive cybersecurity concepts into practical training tailored to sponsors' network topologies, staffing, funding, and technical resources.
 * Develop hands-on training scenarios and exercises that reflect real-world incident response challenges and sponsor mission needs.
 * Help sponsors develop, assess, and improve incident response plans, playbooks, and workflows for investigating, containing, and recovering from cyber incidents.
 * Apply MITRE ATT&CK® to characterize adversary behavior, support incident investigations, and identify opportunities to strengthen defenses.
 * Design, develop, and refine security detections, analytics, and dashboards, and integrate new data sources into security information and event management (SIEM) platforms.
 * Analyze and correlate endpoint, network, and cloud telemetry to determine incident scope, assess impact, and inform containment and remediation recommendations.
 * Assess SOC and incident response capabilities, identify operational and technical gaps, and recommend improvements aligned with sponsor mission priorities and available resources.
 * Support post-incident reviews and exercises, translating lessons learned into improvements to response procedures, detection coverage, and operational readiness.
 * Research and evaluate emerging artificial intelligence techniques, including machine learning and generative AI, with an emphasis on practical, cost-effective applications to SOC operations and incident response.