Security Operations

• Implement technical systems and monitor them for unusual and suspicious activity across a wide range of products.
• Perform “on call” rotation for investigating alerts escalated by the MDR provider, other IT teams, or security tool alerts.
• Assist with articulating security configuration standards for systems and business applications.
• Participate in technical and non-technical projects requiring information security oversight and to ensure policies, procedures and standards are met.
• Serve by aiding in incident response (IR) with the IR and security operations center (SOC) teams.
• Interface with internal and external auditors, along with Compliance team members, for risk assessments as necessary, while providing information requested in a timely manner.
• Recommend new security solutions as well as effective improvements to existing security controls that do not negatively impact business innovation.
• Serve as a liaison for the security team.
• Provide weekly reports to leadership to account for project updates, along with other misc. updates regarding the Security Operations.
• Perform other duties as assigned.

Security Operations Analyst

• Serve as the enterprise technical authority for security orchestration across Splunk SOAR and Tines
• Define and evolve the long‑term architecture, strategy, and roadmap for SOAR and automation platforms
• Establish enterprise standards, reusable frameworks, and orchestration patterns to drive consistency and scale
• Lead end‑to‑end design authority for complex, cross‑platform automation initiatives
• Partner with Product Management and senior leadership to shape portfolio prioritization and strategic investments
• Drive intake governance model, ensuring automation demand is evaluated, prioritized, and aligned to measurable outcomes
• Define and track enterprise value metrics (MTTR reduction, analyst efficiency, operational risk reduction, automation coverage)
• Influence and guide multiple security domain teams (15+ teams) to adopt standardized automation patterns and best practices
• Provide technical leadership and mentorship to senior and principal engineers across SOAR platforms
• Act as escalation point for high‑risk, high‑complexity orchestration challenges and systemic platform issues
• Lead design and oversight of enterprise integrations, including but not limited to: Microsoft Graph / Entra ID / M365 Defender, CrowdStrike Falcon, Tanium, BloodHound, Anvilogic, ThreatQ, ServiceNow (Incidents, SecOps, CMDB, IR workflows)
• Drive platform reliability, resilience, and auditability standards across all automation implementations
• Define enterprise vision for AI‑driven security operations, including copilots, agents, and MCP‑aligned orchestration
• Lead design of AI‑assisted investigation, triage, and response workflows integrated with SOAR decisioning
• Establish and enforce enterprise AI governance framework, including: Human‑in‑the‑loop approval models and escalation paths, Deterministic fallback and fail‑safe execution patterns, Access controls, observability, logging, and auditability aligned with enterprise risk standards
• Define architectural patterns for AI‑integrated SOAR systems, including: Retrieval‑Augmented Generation (RAG) design and secure knowledge integration, Vector embedding strategies for semantic search and correlation, Scalable data pipelines for incident context, detections, and response history
• Evaluate and approve AI use cases based on operational value, risk, and production readiness
• Partner with governance, risk, and compliance teams to ensure safe, auditable deployment of AI capabilities.

Security Incident Response Lead

• Lead day-to-day SOC operations across cloud and on-prem environments
• Serve as Incident Commander for major security incidents
• Drive AI-powered security operations, automation, and threat detection initiatives
• Lead detection engineering, threat hunting, and response improvements
• Own and optimize SIEM, SOAR, EDR/XDR, and threat intelligence platforms
• Develop incident response plans, playbooks, and automation workflows
• Partner with IT, Cloud, Risk, and Compliance teams to strengthen security posture
• Mentor and develop SOC analysts and security engineers

Manager, Security Operations

• Run daily, weekly, and periodic IT and security checklists, with a focus on Google SecOps/Chronicle monitoring
• Perform health checks across GCP infrastructure, SaaS applications, and security tooling (alerts, compliance, CI/CD pipelines)
• Troubleshoot security or infrastructure issues, document fixes, and raise follow-up actions
• Collaborate with DevOps and InfraOps on platform-level and security-related issues
• Identify and propose security and platform improvements as you gain business context
• Implement automation, security tooling, and platform enhancements to strengthen cloud and SaaS environments
• Contribute to scripts, dashboards, and operational improvements with a focus on security and compliance
• Feed insights from day-to-day work into long-term IT security and operational strategy
• Occasionally assist with IT support tasks across systems, hardware, and software
• Prioritize tasks effectively and align timelines with stakeholders

IT & Security Operations Analyst

• Lead and manage retail security programs using a risk-based approach
• Identify security risks in stores and implement solutions to reduce them
• Oversee and evaluate security vendor (guard) performance
• Improve security policies, procedures, and overall safety programs
• Respond to and manage security incidents and investigations
• Oversee physical security across assigned locations
• Analyze data and trends to identify potential threats
• Support threat intelligence efforts and share findings with leadership
• Work closely with internal teams to achieve security goals
• Deliver security training (e.g., workplace violence, travel safety)
• Build relationships with law enforcement and external partners
• Help manage security budgets and strategic plans

Security Operations Manager – Enterprise Security

• Support enterprise incident response activities across detection, triage, containment, eradication, and recovery
• Coordinate the execution of high-impact cybersecurity incidents, in support of Cybersecurity leadership
• Serve as an operational escalation point for incident response, ensuring issues are appropriately routed and addressed
• Develop and maintain incident response playbooks, procedures, and standards
• Support coordination with legal, compliance, IT, and external response partners under the direction of Cybersecurity leadership
• Lead post-incident reviews with relevant stakeholders to identify improvements and strengthen organizational readiness
• Lead security operations activities focused on SOC services, including security monitoring, alert management, and incident response execution
• Oversee internal teams and external service providers (e.g., MSSPs) to ensure consistent, high-quality security operations coverage
• Establish and enforce operational standards for alert triage, escalation, and incident handling
• Drive scalability and efficiency through automation, orchestration, and process optimization
• Ensure effective monitoring coverage across Microsoft 365 Commercial and Government Community Cloud High (GCCH) environments
• Own and evolve security operations technologies, including security information & event monitoring (SIEM) and detection and response platforms
• Define and govern how multiple SOCs (internal and external) operate together, ensuring clear roles, responsibilities, and coordination models
• Establish IDEX Cybersecurity as the lead authority for major incident response, with external SOCs supporting detection and escalation
• Manage relationships with external SOC providers, including performance oversight, metrics, and participation in QBRs
• Improve detection fidelity through alert tuning, use case development, and false positive reduction
• Drive enhancements in detection coverage, response speed (MTTR), and overall operational effectiveness
• Partner with cybersecurity leadership to define operational roadmap, priorities, and maturity targets
• Coordinate cybersecurity requests and activities across teams, ensuring work is properly triaged, prioritized, and completed
• Manage ticketing and escalation processes, ensuring issues are routed, tracked, and resolved in a timely manner
• Track and communicate the status of incidents, initiatives, and key activities across teams
• Partner with IT and project management office (PMO) teams to ensure cybersecurity requirements are built into projects and services from the start
• Promote consistent, security-first practices across IT operations and service delivery
• Own security operations performance metrics and reporting, including MTTR, detection effectiveness, alert quality, and service level agreements (SLAs)
• Develop and enhance operational metrics and dashboards to support enterprise reporting and risk visibility
• Use data-driven insights to identify gaps, inefficiencies, and improvement opportunities
• Drive continuous improvement initiatives to enhance operational maturity, scalability, and consistency
• Support coordination of cybersecurity readiness efforts, including tabletop exercises and crisis simulations
• Mentor and develop team members and stakeholders in incident response practices
• Support knowledge transfer and training initiatives to improve enterprise-wide response capabilities
• Contribute to development and maintenance of operational documentation and standards.

Senior Manager, Cybersecurity Incident Response – Security Operations

• Overseeing and monitoring multiple feeds in a 24/7 environment to detect, verify, and respond to cyber threats
• Collaborating with multiple teams and personnel, including other SOC analysts and subject matter experts
• Participating in red-team/blue-team simulated attacks and tabletop exercises
• Partnering with Security Design and Architecture Engineers to implement and improve technology and processes to enhance SOC monitoring, investigation, and response capabilities

Senior SOC Analyst – 2ND/3RD SHIFT

• Join our Cybersecurity team
• Build hands-on experience with enterprise cybersecurity solutions
• Monitor, analyze, and respond to security events
• Collaborate with cross-functional teams including networking, systems, and support teams to strengthen and maintain the organization’s security posture

Cybersecurity, SOC Analyst

• Work with the technical lead on cybersecurity project scopes
• Work with Team to develop strategy and timeline to meet project’s milestones and deliverables
• Participate in network design, security architecture, and diagrams
• Participate in hardware, software, and communications media specification
• Participate in device configurations and hardening for security compliance and Risk Management
• Work with Team to ensure timely delivery of high-quality cybersecurity documentation including security policies and procedures, RMF artifacts, configuration guides, testing reports, and training materials
• Participate in cybersecurity assessments including vulnerability and compliance scanning and reporting
• Participate in S&C’s Information Security program as it applies to customer facing services
• Must be able to work independently in a fully remote environment
• Ability to relay technical information to non-technical audiences
• Function effectively within a global teams environment and under minimal supervision
• Ability to travel internationally and out of state on average 4-5 times per year for 1-3 weeks per trip
• Maintains regular and punctual attendance.
• Attends in-person or virtual meetings as requested or required.
• Communicates effectively and respectfully with others.
• Other responsibilities as assigned.

Associate Cyber Security Operations Analyst

• Analyze intricate cybersecurity challenges
• Cultivate substantial relationships with clients
• Broaden technical knowledge and proficiency in cybersecurity
• Develop and optimize detection rules, use cases, and playbooks within XSIAM OR Google SecOps
• Assist with onboarding new data sources and security tools integration for enriched threat visibility

Security Operations jobs in Illinois

See all jobs on JobTailor