Security Operations Engineer

Job Description:

• Manage, triage, and validate container, host, and cloud infrastructure findings across enterprise scanners
• Prioritize vulnerabilities, validate false positives, and enforce remediation SLAs across product engineering queues
• Serve as Incident Commander during critical-severity SBG security incidents
• Lead cross-functional triage calls and direct containment and eradication strategies
• Coordinate forensics and facilitate postmortem retrospectives
• Analyze multi-source telemetry in enterprise SIEMs and endpoint auditing tools
• Detect adversary tactics mapped to the MITRE ATT&CK framework
• Execute hypothesis-driven threat hunts
• Convert threat-hunt findings into automated detections and alerting rules
• Partner with governance teams to collect, validate, and orchestrate technical control evidence for compliance audits
• Engineer automated workflows, runbooks, and Python scripts to eliminate operational bottlenecks and technical debt
• Leverage AI/LLM tooling and REST APIs to accelerate triage workflows and enhance threat analysis

Requirements:

• 4+ years of hands-on experience in a dedicated Security Operations Center, Cloud Security, or Incident Response role within a modern enterprise environment
• Experience with AWS, Azure, and GCP cloud architecture
• Experience with vulnerability lifecycle management and operating/tuning vulnerability management pipelines
• Understanding of CVSS and EPSS scoring
• Experience driving remediation across complex microservice environments
• Experience managing high-pressure incident response workflows following NIST SP 800-61 / ISO standards
• Experience querying, correlating, and interpreting security logs in enterprise SIEM platforms, including Splunk, and Linux system logs
• Experience authoring postmortems and SOPs
• Experience leveraging AI/LLMs for alert enrichment, ticket classification, or operational automation
• Bachelor’s degree in Cybersecurity, Information Systems, or equivalent experience (preferred)
• Experience with Python automation and scripting
• Experience with physical data center security
• Experience consuming REST APIs, including Jira, GitHub, and cloud APIs
• Familiarity with Kubernetes and container security scanners such as Wiz or Falco
• Industry-recognized credentials such as CISSP, AWS Certified Security – Specialty, GIAC (GCIH/GCFA/GCDA), or Splunk Core Certified Power User/Admin
• Experience and availability to participate in a distributed team on-call rotation

Benefits:

• Medical, dental and vision insurance
• 401(k) plan with a Cisco matching contribution
• Paid parental leave
• Short- and long-term disability coverage
• Basic life insurance
• Cisco restricted stock unit grants may be available
• 10 paid holidays per full calendar year
• 1 floating holiday for non-exempt employees
• 1 paid day off for employee’s birthday
• Paid year-end holiday shutdown
• 4 paid days off for personal wellness
• 16 days of paid vacation per full calendar year for non-exempt employees
• Flexible vacation time off program with no defined limit for eligible exempt employees
• 80 hours of sick time on hire date and each January 1st thereafter
• Up to 80 hours of unused sick time carried forward
• Additional paid time away for critical or emergency family issues
• Optional 10 paid volunteer days per full calendar year
• Annual bonuses for non-sales roles, subject to Cisco policies
• Continuous learning, mentorship, and career growth opportunities