Senior Cybersecurity Analyst

AeroVironment•Simi Valley, CA

About The Position

The Senior Cybersecurity Analyst leads the investigation, containment, and remediation of cybersecurity incidents across the organization. The role is a technical escalation point for complex security events, coordinates response activities with IT, engineering, legal, and business stakeholders, and provides guidance to less-experienced analysts. The position calls for expertise in endpoint and network forensics, SIEM and EDR technologies, threat hunting, incident leadership, and security automation. The analyst leads incidents from initial triage through containment, eradication, recovery, and closure; examines telemetry and digital evidence; coordinates operationally appropriate containment and remediation; and communicates findings and recommendations to technical teams and leadership. The analyst also improves response capabilities through post-incident reviews, playbooks, detection and automation improvements, and analyst mentoring. Participation in an on-call rotation and after-hours response to critical incidents is required as needed. The role requires 5+ years of relevant experience. A bachelor's degree in a related field or equivalent practical experience is desired. The position requires access to ITAR- and/or EAR-controlled information, so applicants must qualify as a U.S. person or be eligible for an export license; some positions require current U.S. citizenship due to contract requirements. The role has a Secret clearance level, and the posting also describes an active U.S. security clearance or ability to obtain and maintain one as a desired qualification.

Requirements

5+ years of experience in cybersecurity incident response, security operations, digital forensics, or a related discipline.
Demonstrated experience leading investigations and responses to complex incidents, including ransomware and malware, phishing and business email compromise, account compromise and credential theft, insider threats, data exfiltration, and unauthorized access and privilege escalation.
Strong knowledge of incident response processes, including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
Experience using SIEM platforms, EDR tools, network monitoring and intrusion detection systems, vulnerability management platforms, and digital forensic and malware analysis tools.
Proficiency analyzing operating system logs, authentication logs, network traffic, endpoint telemetry, and cloud security events.
Knowledge of MITRE ATT&CK, the Cyber Kill Chain, and the NIST Incident Response Framework.
Experience with scripting or automation using PowerShell, Python, Bash, or similar tools.
Ability to write clear incident reports, technical findings, executive summaries, and after-action reports.
Ability to participate in an on-call rotation and respond effectively during high-severity incidents.
Strong communication, analytical, decision-making, and incident leadership skills.
Ability to maintain confidentiality and handle sensitive information appropriately.
Applicants must qualify as a U.S. person under ITAR/EAR or be eligible for an export license; some positions require current U.S. citizenship due to contract requirements.
The position has a Secret clearance level.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.
Professional certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA), CISSP, Security+, or Certified Ethical Hacker (CEH).
Experience leading incident response activities in enterprise, manufacturing, aerospace, defense, or other regulated environments.
Experience with Microsoft Azure, AWS, or Google Cloud.
Experience investigating identity and access systems, including Active Directory, Entra ID, Okta, or similar platforms.
Knowledge of security and privacy requirements such as NIST 800-61, NIST 800-53, ISO 27001, CMMC, ITAR, or FedRAMP, as applicable.
Experience with threat hunting, malware triage, reverse engineering, memory forensics, and disk forensics.
Experience developing incident response playbooks, detection logic, automation, and operational metrics.
Prior experience mentoring junior analysts or coordinating cross-functional response teams.
Active U.S. security clearance, or the ability to obtain and maintain one.

Responsibilities

Lead complex cybersecurity investigations from initial triage through containment, eradication, recovery, and closure, ensuring timely execution and thorough documentation.
Serve as the primary technical lead for escalated security incidents, set investigation priorities, assign tasks, and coordinate response across analysts and technical teams.
Analyze endpoint, identity, email, network, and cloud telemetry to determine incident scope, attack vectors, affected assets, adversary activity, and potential business impact.
Develop incident timelines and identify root causes, persistence mechanisms, lateral movement, and indicators of compromise.
Collect, preserve, and analyze digital evidence in accordance with evidence-handling, chain-of-custody, and retention procedures.
Coordinate containment and remediation with IT, engineering, application owners, and business stakeholders while balancing urgency with operational requirements.
Investigate phishing, account compromise, malware, ransomware, unauthorized access, data exfiltration, and suspected insider threats within approved investigative authority.
Use Microsoft Sentinel, Microsoft Defender, and other security platforms to correlate alerts, develop investigative queries, and validate findings.
Conduct threat hunts based on incident findings, threat intelligence, and adversary techniques to identify previously undetected activity.
Maintain incident records and provide technical findings, executive summaries, status updates, and actionable recommendations.
Escalate significant incidents and coordinate with leadership, Legal, Human Resources, Privacy, and Compliance as appropriate.
Lead post-incident reviews, identify control gaps, and track corrective actions through verified completion.
Develop and maintain investigation playbooks, response procedures, escalation criteria, and evidence-collection guidance.
Partner with security engineers to improve detection coverage, reduce false positives, and automate repeatable investigative and response tasks.
Mentor analysts, review investigation quality, and strengthen team capabilities through case reviews, exercises, and knowledge sharing.
Participate in the on-call rotation and lead after-hours response to critical security incidents as required.