Security Operations

• Serve as the enterprise technical authority for security orchestration across Splunk SOAR and Tines
• Define and evolve the long‑term architecture, strategy, and roadmap for SOAR and automation platforms
• Establish enterprise standards, reusable frameworks, and orchestration patterns to drive consistency and scale
• Lead end‑to‑end design authority for complex, cross‑platform automation initiatives
• Partner with Product Management and senior leadership to shape portfolio prioritization and strategic investments
• Drive intake governance model, ensuring automation demand is evaluated, prioritized, and aligned to measurable outcomes
• Define and track enterprise value metrics (MTTR reduction, analyst efficiency, operational risk reduction, automation coverage)
• Influence and guide multiple security domain teams (15+ teams) to adopt standardized automation patterns and best practices
• Provide technical leadership and mentorship to senior and principal engineers across SOAR platforms
• Act as escalation point for high‑risk, high‑complexity orchestration challenges and systemic platform issues
• Lead design and oversight of enterprise integrations, including but not limited to: Microsoft Graph / Entra ID / M365 Defender, CrowdStrike Falcon, Tanium, BloodHound, Anvilogic, ThreatQ, ServiceNow (Incidents, SecOps, CMDB, IR workflows)
• Drive platform reliability, resilience, and auditability standards across all automation implementations
• Define enterprise vision for AI‑driven security operations, including copilots, agents, and MCP‑aligned orchestration
• Lead design of AI‑assisted investigation, triage, and response workflows integrated with SOAR decisioning
• Establish and enforce enterprise AI governance framework, including: Human‑in‑the‑loop approval models and escalation paths, Deterministic fallback and fail‑safe execution patterns, Access controls, observability, logging, and auditability aligned with enterprise risk standards
• Define architectural patterns for AI‑integrated SOAR systems, including: Retrieval‑Augmented Generation (RAG) design and secure knowledge integration, Vector embedding strategies for semantic search and correlation, Scalable data pipelines for incident context, detections, and response history
• Evaluate and approve AI use cases based on operational value, risk, and production readiness
• Partner with governance, risk, and compliance teams to ensure safe, auditable deployment of AI capabilities.

Security Incident Response Lead

• Support development, improve proficiency, and increase operational effectiveness of USSF Cyber Squadron personnel
• Provide cyber defense remediation and mitigation implementation recommendations in support of all incidents/events
• Participate in the planning process for Operational Planning Teams (OPTs) and crew shift planning
• Draft and validate accuracy of squadron level DCO Tactics, Techniques, and Procedures (TTPs)
• Conduct analysis on new DCO-Space capability releases
• Provide recommendations for exercises and mission rehearsals
• Maintain proficiency by performing DCO crew operation for assigned space mission systems
• Provide expertise for DCO-Space capabilities such as SIEM, Intrusion Detection and Prevention Systems, ELK Stack, Endpoint Protection Systems
• Advise and assist with cyber incident response processes IAW squadron policies
• Participate in Government-established Cyber Incident Response Teams (CIRTs) and provide technical assistance
• Recommend cyber incident response best practices to improve TTPs, processes, and policies

Defensive Cyber Operations SME

• Lead the retail security operating model for company-owned stores while providing governance, advisory support, standards alignment, escalation coordination, and risk visibility for branded partner locations.
• Build and mature enterprise governance structures, operational processes, reporting frameworks, standards, and accountability models.
• Oversee key retail security programs, including guard force operations, cash logistics, alarm systems, video management, and asset protection technologies.
• Establish performance metrics, dashboards, scorecards, and executive reporting that provide visibility into security risks, loss trends, compliance, vendor performance, and operational effectiveness.
• Coordinate cross-functional response and escalation for retail security incidents, operational risks, vendor issues, and emerging threats.
• Drive vendor performance through service-level expectations, scorecards, governance routines, and continuous improvement initiatives.
• Partner closely with Retail Operations, Supply Chain, Finance, Audit, regional teams, branded partner stakeholders, and business leaders to strengthen controls, improve store readiness, and reduce risk.
• Support investigative teams through operational coordination, reporting, and process enablement without assuming primary responsibility for investigations.
• Influence outcomes across a highly matrixed environment through partnership, governance, relationship management, and executive alignment rather than direct authority.
• Support branded partner locations through influence, advisory support, standards alignment, and relationship-led governance rather than direct operational control.

Director, Retail Security Operations

• Contribute to sales strategy and consultative discovery
• Drive XSIAM revenue across all segments
• Initiate executive relationships with prospective customers
• Demonstrate the business value of XSIAM
• Craft customer-specific proposals and business cases
• Collaborate across sales teams to achieve synergies

SecOps Transformation Advisor

• Run daily, weekly, and periodic IT and security checklists, with a focus on Google SecOps/Chronicle monitoring
• Perform health checks across GCP infrastructure, SaaS applications, and security tooling (alerts, compliance, CI/CD pipelines)
• Troubleshoot security or infrastructure issues, document fixes, and raise follow-up actions
• Collaborate with DevOps and InfraOps on platform-level and security-related issues
• Identify and propose security and platform improvements as you gain business context
• Implement automation, security tooling, and platform enhancements to strengthen cloud and SaaS environments
• Contribute to scripts, dashboards, and operational improvements with a focus on security and compliance
• Feed insights from day-to-day work into long-term IT security and operational strategy
• Occasionally assist with IT support tasks across systems, hardware, and software
• Prioritize tasks effectively and align timelines with stakeholders

IT & Security Operations Analyst

• Own and work the IT ticket queue: respond to incidents, problems, and service requests, and resolve end-user issues promptly.
• Troubleshoot hardware, software, and networking issues across endpoints, servers, and applications.
• Install, configure, maintain, and administer servers, operating systems, and applications.
• Support operational, technical, and system requirements for server location, installation, operation, and maintenance.
• Prepare and maintain operating procedures for technical support, troubleshooting, and routine systems administration.
• Onboard new employees with the appropriate technical solutions, accounts, and software, including troubleshooting.
• Monitor security events and alerts using SIEM tools and other security technologies.
• Analyze and triage security alerts to determine severity and potential impact.
• Perform initial incident response activities and escalate issues when necessary.
• Document and track security incidents and their resolutions.
• Collaborate with the SOC team and contribute to security documentation and procedures.

IT Administrator / SOC Analyst

• Plans, organizes, and directs the activities of regional and on-site security managers
• Ensures compliance with legal and regulatory requirements
• Collaborates with corporate security management and facility service staff
• Implements procedures for visitor controls and associate identification
• Briefs senior and executive management on security issues and compliance
• Develops and recommends policies, procedures, and standards
• Hires, trains, coaches, and evaluates performance of direct reports

Director of Security Operations

• Actively participate in 24x7 operations of the Long View Security Operations Centre
• Monitor, identify and validate security events generated from Security Information Event Management (SIEM) tools
• Actively work in monitoring, event and incident management tools like Sentinel and ServiceNow
• Respond to critical business impacting situations and coordinate the efforts required to engage the proper resources to remediate the issue
• Coordinate major security incident situations and provide internal communications via email in a timely manor
• Provide general support for Security Information Event Management (SIEM) tool changes, tweaks, additions and updates within Sentinel and any additional tools leveraged by Long View
• Provide security guidance to team members across the organization how to best identify, contain and remediate security related incidents
• Understand complex issues across on-premise, public and private cloud solutions and articulate the impact to higher tier team members
• Follow and establish process documentation for receipt of security alerts for monitored devices, acknowledge the receipt of the event, opening and/or updating service desk tickets to track the handling of events to resolution and closure, assignment of the ticket to the appropriate owner
• Work with cloud technologies like Azure, AWS and Google Cloud Platform
• Fulfill reporting requests that can be pulled from Long View tools

Junior Security Operations Center Analyst

• Zero-Trust System Design: Draft, review, and maintain zero-trust SOPs across identity, device, data, and infrastructure.
• Infrastructure-as-Code & Automation: Extend Net-Sec-Ops pipelines with IaC (Ansible) for firewalls, switches, SD-WAN, and edge fabric.
• Systems Resilience & Disaster Recovery: Architect and automate backup, failover, and DR workflows for all network devices.
• Security & Compliance Orchestration: Integrate vulnerability scanners (Nessus, Qualys), threat-intel feeds, and policy-as-code into CI/CD pipelines.
• Network Configuration & Lifecycle Management: Operate configuration managers to centralize topology, inventory, and device state.
• Cross-Functional Architecture Governance: Collaborate with platform, edge, security, and product teams to embed network security into CI/CD and DevOps pipelines.
• Capacity & Performance Modeling: Model traffic and compute link utilization; forecast capacity needs using historical data and predictive analytics.
• Continuous Process & Tool Improvement: Evaluate emerging trends; propose tool/process changes to reduce manual effort and improve security posture.
• Prototyping & Customer Validation: Rapidly spin up proof-of-concept environments to test complex customer requests.

Security Operations jobs in Colorado

See all jobs on JobTailor