Security Operations

• Own the end-to-end application security pipeline: SAST, DAST, SCA, secrets detection, IaC scanning, and container scanning across the Enterprise code estate
• Define and enforce control gates
• Manage the pipeline gating philosophy
• Own the exception register, including time-bound exceptions with named compensating controls and expiry dates
• Drive migration of production code into Enterprise GitHub to enable uniform scanning, gating, and provenance tracking
• Analyze modern and legacy programming languages
• Operationalize Cisco AI Defense and Multi-Cloud Defense across the major public cloud providers
• Serve as a technical advisor to the AIGC, delivering validation reports, AI SBOMs, and risk inputs
• Define and enforce AI guardrails policy including data classification enforcement, prompt injection defense, output safety controls, and agent action/tool-use limits partnering with development and product teams
• Oversee the phased AI Defense deployment roadmap from foundation through full enforcement
• Consult on shadow AI discovery and employee AI tool usage
• Lead the DevSecOps Analyst, setting priorities, developing skills, and reviewing work quality
• Coordinate the engineering resources on pipeline engineering, tool administration, and cloud posture work
• Build and sustain a security champions network with champions in each development team, providing coaching, training, and support
• Publish program metrics regularly

Lead, Dev SecOps

• Plans, organizes, and conducts investigations related to both internal and external security issues
• Analyzes and evaluates investigative progress to assess priorities, leads, and predetermines goals and objectives
• Develops, trains, and directs external security personnel
• Establishes connections between suspects and other violators by linking evidence uncovered from various sources
• Develop investigative strategy, interview employees and vendors, obtain admissions, and document investigation with evidence
• Implements policies, procedures, and systems to maintain and enhance the organizational mission
• Interprets and applies laws, orders, rules, and regulations pertaining to enterprise policy and procedure
• Collaborate with all company stakeholders
• Maintains a liaison with local, state, and federal law enforcement agencies
• Prepares clear, comprehensive, and cohesive investigative reports
• Reviews and analyzes functional business operations to recommend strategies for prevention, mitigation, and recovery
• Develops and presents training programs for employees, contractors, and temporary employees

Security Operations Analyst I

• Live by the NuHarbor corporate values: Help Clients Win, Always Improve, Protect the House.
• Own investigations end-to-end from initial alert through root cause analysis and client-ready written narrative.
• Correlate across SIEM, EDR, and identity telemetry to identify missed alerts.
• Support the Security Analyst team with alert triage and escalation within SLA requirements.
• Communicate proactively with the Security Operations Manager on active threats and escalations.
• Produce ticket documentation without editorial cleanup.
• Remain current on emerging threats, CVEs, and attacker techniques.
• Train, mentor, and support junior analysts.
• Review escalations prior to client delivery, ensuring documentation quality.

Senior Security Operations Analyst

• Monitor security events and logs from a variety of systems and networks in Datadog
• Identify potential security incidents and threats
• Perform analysis and investigations, correlating events and data to detect security incidents
• Develop, document, and evolve processes and procedures for responding to security incidents
• Provide technical guidance, training, and support to other members of the security team
• Maintain an up-to-date knowledge of security threats, vulnerabilities, and countermeasures
• Work independently with customers on implementations and remote services
• Troubleshoot basic configuration/script issues
• Attend requirements review and validation sessions as needed
• Utilize strong written and verbal communication skills
• Stay on time and on task with assigned customer work

Senior Security Operations Center (SOC) Analyst

• Handle complex incident response and escalation. Take ownership of high-severity and technically complex incidents — leading investigation, driving containment decisions, and communicating findings clearly when it counts.
• Assess and improve telemetry and logging coverage. Automate evaluation of customer environments for logging gaps and deficiencies across endpoint, network, identity, and cloud. Specify what's needed for effective detection and investigation, and work with customers and internal teams to close the gaps.
• Ensure SIEM and detection quality. Apply deep platform knowledge to evaluate detection fidelity, data normalization, parser quality, and alert logic — identifying where coverage or quality falls short and partnering with detection engineering to address it.
• Contribute to response automation quality. Work closely with the SOAR team to review enrichment logic, containment playbooks, and automation design — bringing an incident responder's perspective to what works under pressure and what doesn't.
• Support technical needs across the organization. Serve as a knowledgeable resource for forward-deployed engineers, onboarding teams, and customers on questions spanning telemetry, investigation, platform behavior, and response — representing the SOC's technical depth across functions.
• Improve SOC tooling and operational workflows. Identify friction in how analysts triage, investigate, and respond. Partner on tooling improvements, process changes, and reference content that raise consistency and quality across the team.

SOC Engineer

• Lead a team of professionals using cyberspace capabilities to evaluate potential weaknesses
• Assist in developing strategies, doctrine, policies, directives, and instructions
• Make recommendations to ensure compliance to support full-spectrum Cyberspace Operations
• Provide domain and functional subject matter input to briefings
• Transition concepts to execution
• Assist in the coordination of operational planning in support of training, exercises, combat, and contingency plans and operations
• Use research and analysis expertise to assess and inform operators and senior leadership on dynamic tactics, techniques, and procedures for the Army

Cyber Operations Planner

• Monitor and analyze security alerts from SIEM and other tools
• Investigate suspicious activities and escalate confirmed incidents
• Perform threat analysis and containment procedures
• Document incidents and maintain security logs
• Collaborate with IT and security teams to improve detection and response
• Contribute to tuning security tools and updating playbooks

SOC Analyst

• Support enterprise incident response activities across detection, triage, containment, eradication, and recovery
• Coordinate the execution of high-impact cybersecurity incidents, in support of Cybersecurity leadership
• Serve as an operational escalation point for incident response, ensuring issues are appropriately routed and addressed
• Develop and maintain incident response playbooks, procedures, and standards
• Support coordination with legal, compliance, IT, and external response partners under the direction of Cybersecurity leadership
• Lead post-incident reviews with relevant stakeholders to identify improvements and strengthen organizational readiness
• Lead security operations activities focused on SOC services, including security monitoring, alert management, and incident response execution
• Oversee internal teams and external service providers (e.g., MSSPs) to ensure consistent, high-quality security operations coverage
• Establish and enforce operational standards for alert triage, escalation, and incident handling
• Drive scalability and efficiency through automation, orchestration, and process optimization
• Ensure effective monitoring coverage across Microsoft 365 Commercial and Government Community Cloud High (GCCH) environments
• Own and evolve security operations technologies, including security information & event monitoring (SIEM) and detection and response platforms
• Define and govern how multiple SOCs (internal and external) operate together, ensuring clear roles, responsibilities, and coordination models
• Establish IDEX Cybersecurity as the lead authority for major incident response, with external SOCs supporting detection and escalation
• Manage relationships with external SOC providers, including performance oversight, metrics, and participation in QBRs
• Improve detection fidelity through alert tuning, use case development, and false positive reduction
• Drive enhancements in detection coverage, response speed (MTTR), and overall operational effectiveness
• Partner with cybersecurity leadership to define operational roadmap, priorities, and maturity targets
• Coordinate cybersecurity requests and activities across teams, ensuring work is properly triaged, prioritized, and completed
• Manage ticketing and escalation processes, ensuring issues are routed, tracked, and resolved in a timely manner
• Track and communicate the status of incidents, initiatives, and key activities across teams
• Partner with IT and project management office (PMO) teams to ensure cybersecurity requirements are built into projects and services from the start
• Promote consistent, security-first practices across IT operations and service delivery
• Own security operations performance metrics and reporting, including MTTR, detection effectiveness, alert quality, and service level agreements (SLAs)
• Develop and enhance operational metrics and dashboards to support enterprise reporting and risk visibility
• Use data-driven insights to identify gaps, inefficiencies, and improvement opportunities
• Drive continuous improvement initiatives to enhance operational maturity, scalability, and consistency
• Support coordination of cybersecurity readiness efforts, including tabletop exercises and crisis simulations
• Mentor and develop team members and stakeholders in incident response practices
• Support knowledge transfer and training initiatives to improve enterprise-wide response capabilities
• Contribute to development and maintenance of operational documentation and standards.

Senior Manager, Cybersecurity Incident Response – Security Operations

• Monitor SIEM, EDR, IDS/IPS, email security, vulnerability, and other security platforms for suspicious activity.
• Triage alerts and distinguish false positives from actionable security events.
• Investigate security events using log data, endpoint telemetry, network data, and threat intelligence.
• Escalate incidents in accordance with severity, impact, and response procedures.
• Document investigations, findings, and actions taken in ticketing/case management systems.
• Support incident handling activities including containment, evidence collection, and coordination with technical teams.
• Review vulnerability findings and assist with prioritization and routing to responsible teams.
• Participate in shift turnover reporting and maintain accurate operational notes.
• Support development and refinement of detection rules, playbooks, and standard operating procedures.
• Contribute to metrics reporting such as alert volumes, escalation rates, false positives, and response timelines.

SOC Analyst Tier 2

• Monitor SIEM, EDR, IDS/IPS, email security, vulnerability, and other security platforms for suspicious activity
• Perform initial triage of alerts and identify potential false positives versus events requiring further investigation
• Collect and review basic log data, endpoint telemetry, and network activity to support analysis
• Escalate suspected security incidents to Tier II/III analysts in accordance with defined procedures
• Document alerts, actions taken, and relevant details in ticketing/case management systems
• Follow established playbooks and standard operating procedures for alert handling
• Support incident response activities by gathering information and coordinating with senior analysts as needed
• Assist with vulnerability findings review and route issues to appropriate teams
• Participate in shift turnover reporting and maintain accurate operational notes
• Contribute to maintaining accurate documentation and knowledge base articles
• Other responsibilities as assigned

SOC Analyst Tier 1

• Define top-level or cross-subsystem digital architecture for Satellite communication ASICs and SoCs.
• Lead hardware realization of key communication functions such as modem pipelines, coding engines, digital beamforming, switching fabrics, and packet/data processing.
• Drive end-to-end technical planning from concept through silicon validation.
• Establish system-level tradeoffs among throughput, latency, power, die area, reliability, and manufacturability.
• Provide technical leadership across design, verification, physical design, firmware, packaging, and system teams.
• Review and influence architectural partitioning between ASIC, FPGA, software, and RF/analog domains.
• Develop methodologies and reusable IP strategies that improve schedule, quality, and scalability.
• Mentor technical leaders and act as a go-to expert for critical design reviews and issue resolution.
• Support roadmap planning and future product definition.

Principal Modem SoC Engineer

• Monitor, triage, and investigate alerts across SIEM, EDR, NDR, and DLP platforms
• Lead or support incident response activities including scoping, containment, eradication, and post-incident review in alignment with NIST SP 800-61r2
• Develop, tune, and maintain detection rules, correlation queries, and behavioral models across the security stack
• Conduct threat hunting exercises using structured methodologies (MITRE ATT&CK, hypothesis-driven)
• Build and maintain security automation workflows to reduce manual triage and accelerate response (Python, PowerShell, GitHub Actions, REST APIs)
• Integrate security tooling with ticketing and workflow platforms (Jira) for consistent case management and SLA tracking
• Contribute to SOAR playbook development and refinement
• Support vulnerability management operations including Tenable scan management, findings triage, and Jira-based remediation tracking
• Maintain and optimize SIEM content, log pipelines, and data sources; ensure complete and accurate log ingestion from cloud, endpoint, network, and identity layers
• Manage and tune EDR policies, exclusions, and response actions within CrowdStrike Falcon
• Support DLP policy operations, including investigation support for policy violations
• Maintain firewall log visibility and coordinate with network/infrastructure teams on Fortinet policy enforcement
• Support evidence collection and control testing for HITRUST CSF v11 and SOC 2 Type II assessments
• Contribute to security documentation including runbooks, playbooks, and operational procedures
• Participate in tabletop exercises and contribute to lessons-learned outcomes
• Support identity and access-related security reviews in collaboration with the IAM/infrastructure team
• Monitor and investigate anomalous activity associated with AI agent infrastructure, API integrations, and LLM-based services
• Contribute to security controls and detection coverage for AI workloads under the organization’s AI governance framework
• Help develop behavioral baselines and detection logic specific to AI/agentic traffic patterns

Security Operations Engineer

• Own the working relationship with CSG on data residency, PII handling, access governance, and model security controls
• Translate policy into guardrails the delivery team and citizen developers can act on
• Build and maintain security tooling, guardrail enforcement, and policy-as-code integrations across Enterprise AI platforms
• Reduce manual review through automation where possible
• Develop reusable security components and patterns that delivery teams and citizen developers can drop into Agent builds—making the secure path the easy path
• Instrument AI platforms to detect anomalous behavior, access patterns, and policy violations
• Build the detection layer, not just consume it

AI SecOps Engineer

• Monitor and manage the Information Security request queue, including analysis and resolution of outstanding issues.
• Manage endpoint and network security environments including overall health, policy modifications, troubleshooting/resolving issues and producing monthly health metrics for workstations, servers, and identities.
• Work directly with the Information Security Team and Security Operations Center (SOC) to analyze and resolve security events/alerts. This includes some monitoring and management of the SIEM platform.
• Manage and maintain Information Security training and awareness campaigns (e.g., training, phishing). Developing/monitoring campaigns, ensuring required training is complete, producing reports/metrics and recommending improvements to the current process.
• Conduct internal security control testing. Includes gathering, uploading, and reviewing evidence within the GRC (Governance, Risk and Compliance) tool. Supporting PCI, SOC and related audits.
• Other duties as assigned.

Engineer, IT Information Security Operations

• Plans, organizes, and directs the activities of regional and on-site security managers
• Ensures compliance with legal and regulatory requirements
• Collaborates with corporate security management and facility service staff
• Implements procedures for visitor controls and associate identification
• Briefs senior and executive management on security issues and compliance
• Develops and recommends policies, procedures, and standards
• Hires, trains, coaches, and evaluates performance of direct reports

Director of Security Operations

• Actively participate in 24x7 operations of the Long View Security Operations Centre
• Monitor, identify and validate security events generated from Security Information Event Management (SIEM) tools
• Actively work in monitoring, event and incident management tools like Sentinel and ServiceNow
• Respond to critical business impacting situations and coordinate the efforts required to engage the proper resources to remediate the issue
• Coordinate major security incident situations and provide internal communications via email in a timely manor
• Provide general support for Security Information Event Management (SIEM) tool changes, tweaks, additions and updates within Sentinel and any additional tools leveraged by Long View
• Provide security guidance to team members across the organization how to best identify, contain and remediate security related incidents
• Understand complex issues across on-premise, public and private cloud solutions and articulate the impact to higher tier team members
• Follow and establish process documentation for receipt of security alerts for monitored devices, acknowledge the receipt of the event, opening and/or updating service desk tickets to track the handling of events to resolution and closure, assignment of the ticket to the appropriate owner
• Work with cloud technologies like Azure, AWS and Google Cloud Platform
• Fulfill reporting requests that can be pulled from Long View tools

Junior Security Operations Center Analyst

• Support vulnerability management operations
• Analyze security scan results
• Coordinate operating system and third-party patch deployment
• Support malware assessment and remediation efforts
• Maintain security compliance documentation
• Administer MECM patching activities

IT Security Operations Analyst

• Define and evolve Adobe’s Cyber Operations strategy, building a proactive and resilient cybersecurity framework
• Lead transformation across automation, data platforms, and security solutions strengthened by smart technology systems
• Align CyberOps priorities to business strategy, enabling customer trust and innovation
• Shape a scalable operating model across Enterprise Security, Cyber Defense, and Security Engineering
• Own end-to-end cyber defense including detection, response, vulnerability management, identity, and endpoint security
• Ensure global consistency and readiness in incident response
• Strengthen monitoring and visibility for real-time response capabilities
• Drive operational excellence through metrics, dashboards, and continuous improvement
• Lead decisively through high-severity incidents

VP, Cyber Operations

• Lead in daily SOC operations and provide task management and operational oversight.
• Manage user accounts, roles, and permissions across application portfolio.
• Monitor and report on system health concerns for alarms access control, surveillance, incident management and other security systems.
• Supervise the Security Operations team to ensure seamless and continuous GSOC support.
• Validate that operator actions align with runbook and site-specific requirements.
• Coordinate with site security, facilities, REFM, IT, HR, Legal, Comms, and business leadership as required to handle Crisis events.
• Assume Incident Commander role for Crisis-level incidents per escalation policy.
• Maintain a communication cadence during evolving incidents and crisis events as needed.
• Support operators in compiling situational reports and incident summaries.
• Ensure timely triage, categorization, and prioritization of alerts and cases.
• Provide oversight of incident documentation workflows, proper escalation channels and resolutions.
• Coordinate production and delivery of emergency notification and mass communications.
• Conduct post crisis/incident reviews to identify process improvements.
• Assist in creating, updating, and conducting training material with GSOC Operators.
• Assist in onboarding new GSOC staff and training to include tools, procedures, policies, escalation expectations.

Supervisor – Security Operations Center

• Design, develop, and refactor our custom internal security platform across both the backend (FastAPI) and frontend(React).
• Partner with security analysts to turn manual workflows into automated, reliable processes.
• Integrate and operationalise AI/ML utilities (such as LLMs) into our security platform to assist analysts with threat investigation and incident summarisation.
• Work with our infrastructure in GCP, using Kubernetes for orchestration and Terraform for resource management.
• Leverage our monitoring and alerting tools (Prometheus/Grafana) to detect failures early and maintain high availability across the internal security platform the team owns.
• Build and maintain API integrations that connect our detection tools, ticketing systems, and customer environments.
• Champion code quality through code reviews, testing practices and CI/CD pipelines.

See all jobs on JobTailor