Security Operations

• Provide “eyes on glass” near real-time security monitoring in a 24x7 environment by monitoring security infrastructure and security alarm devices for Indicators of Compromise utilizing a proprietary SIEM and cybersecurity tools;
• Perform near real-time security monitoring of alerts and escalating critical alerts in compliance with the service level agreement;
• Detect security incidents and analyze threats for complex and/or escalated security events;
• Perform level 2 assessment of incoming alerts (assessing the priority of the alert, determining severity of alert in respect to customer environment, correlating additional details) and coordinate with Tier-3 for critical priority incidents, if necessary;
• Perform incident response activities utilizing customer SIEM and cybersecurity toolkits;
• Respond to customer Requests For Information including using Linux command line skills to query raw logs for IOCs, answering questions about the MSS infrastructure, and features of the SIEM including correlation engine while recommending best practices;
• Develop internal and/or external documentation, such as detailed procedures, playbooks, and runbooks; review and assess reports concerning operational metrics;
• Assist with quality control during onboarding of new customers to verify validity of Use Cases and generated alerts;
• Utilize the SOC Knowledge Base and provide input on revisions as needed

Public Sector SOC Analyst

• Serve as lead handler for escalated insider risk and cyber incidents; establish investigation strategy, ensure timely execution, and drive incident closure.
• Conduct deep-dive analysis of security events using telemetry, endpoint/network evidence, and threat intelligence to determine scope, impact, and root cause.
• Create, tune, and deploy new detection rules and analytics aligned to evolving threats and suspicious behaviors; reduce false positives and improve signal-to-noise.
• Perform targeted hunts to discover emerging behaviors and translate findings into actionable detections, controls, and playbooks.
• Partner with IT and security stakeholders to drive containment, remediation, and recovery actions across endpoints, identities, and cloud services.
• Contribute to incident response process improvements, documentation standards, and after-action reviews; support development of tabletop exercise scenarios.
• Produce clear, concise updates for leadership (status, impact, risk, and next steps) and deliver required incident reports and post-incident summaries.
• Coach and mentor analysts in triage and investigation practices; serve as a subject matter expert across the incident response organization.
• Build and maintain integrations between multiple enterprise security tools to improve automation, asset inventory accuracy, vulnerability identification, and response workflows.
• Implement AI-assisted monitoring and analytics to improve correlation, enrichment, prioritization, and triage of alerts; reduce manual effort and improve time to decision.
• Develop and maintain risk-scoring approaches for endpoints and users based on security posture, vulnerabilities, and behavioral signals.
• Produce trend analyses and operational health reporting (e.g., coverage, agent health, patch/compliance drift, and incident patterns) and translate results into improvement actions.
• Develop and maintain automation via APIs, scripting, and orchestration to support agent deployment/upgrade workflows, compliance checks and remediation, rapid scoping, containment support, targeted remediation, and continuous control validation.

Lead Cybersecurity – Insider Risk Analyst, Telemetry, Insider Risk Detection, AI-Driven Security Operations

• Support and help engineer endpoint security controls for EDR, DLP, VPN, secure web access, and endpoint visibility platforms.
• Provide Tier‑3 engineering support, including troubleshooting, policy tuning, exclusions, performance analysis, and vendor escalation.
• Standardize endpoint security baselines and deployment patterns to ensure consistent control coverage and user experience.
• Extend and adapt AI‑driven intake, enrichment, and approval workflows established in Mobile Security Operations to endpoint security use cases.
• Apply AI‑assisted techniques for alert correlation, risk scoring, trend analysis, and control drift detection to continuously improve endpoint security operations.
• Partner with Security Operations, Endpoint, IT, and business teams to align security controls with operational needs.

Senior Cybersecurity Engineer – Endpoint Security, AI Enabled Operations

• Ensure consistent incident handling across multiple SOC locations through standardize procedures and communication
• Lead daily operations such as threat briefings, queue health checks, and high-severity incident oversight
• Serve as final escalation for complex investigations (multi-stage intrusions, lateral movement, persistence, data exfiltration)
• Lead containment/eradication strategy in partnership with IT, Cloud, Endpoint, and Network teams
• Perform root-cause analysis and produce actionable remediation guidance
• Coach Tier 1/2 analysts on investigation techniques, log analysis, and response playbooks
• Integrate AI‑driven detections and response

Principal Cybersecurity – Tier-3 Team Lead SOC Analyst

• Implementing and managing physical security measures to protect people, assets, and information
• Conducting risk assessments and designing security systems to enhance safety protocols
• Developing and executing emergency response plans to address potential security threats
• Utilizing CCURE and other security management software for monitoring and incident tracking
• Coordinating with stakeholders to maintain compliance with regulatory standards and security frameworks
• Analyzing security incidents and breaches to inform improvements in security processes
• Overseeing asset protection and business continuity management to minimize operational risks
• Leading security auditing documentation and evaluations to confirm adherence to security standards
• Managing surveillance systems and interpreting footage to identify and address security concerns
• Training team members on security awareness and incident response procedures

Security Operations Analyst – Fixed Term

• Own the end-to-end application security pipeline: SAST, DAST, SCA, secrets detection, IaC scanning, and container scanning across the Enterprise code estate
• Define and enforce control gates
• Manage the pipeline gating philosophy
• Own the exception register, including time-bound exceptions with named compensating controls and expiry dates
• Drive migration of production code into Enterprise GitHub to enable uniform scanning, gating, and provenance tracking
• Analyze modern and legacy programming languages
• Operationalize Cisco AI Defense and Multi-Cloud Defense across the major public cloud providers
• Serve as a technical advisor to the AIGC, delivering validation reports, AI SBOMs, and risk inputs
• Define and enforce AI guardrails policy including data classification enforcement, prompt injection defense, output safety controls, and agent action/tool-use limits partnering with development and product teams
• Oversee the phased AI Defense deployment roadmap from foundation through full enforcement
• Consult on shadow AI discovery and employee AI tool usage
• Lead the DevSecOps Analyst, setting priorities, developing skills, and reviewing work quality
• Coordinate the engineering resources on pipeline engineering, tool administration, and cloud posture work
• Build and sustain a security champions network with champions in each development team, providing coaching, training, and support
• Publish program metrics regularly

Lead, Dev SecOps

• Assist in monitoring and analyzing security events and incidents
• Participate in threat hunting activities to identify potential security threats
• Support incident response efforts, including investigation, containment, and remediation
• Conduct research on emerging cybersecurity threats and vulnerabilities
• Assist in the development and implementation of security operations policies and procedures
• Collaborate with other team members to improve security posture and incident response capabilities

Security Operations jobs in North Carolina

See all jobs on JobTailor