Security Operations Engineer

This is a fully remote position, open to applicants in Colorado, +4 more states.

📋 Description

• Oversee, assess, and verify findings related to containers, hosts, and cloud infrastructure across enterprise scanners.

• Prioritize vulnerabilities, confirm false positives, and enforce remediation Service Level Agreements (SLAs) within product engineering workflows.

• Act as Incident Commander during critical-severity security incidents within the SBG.

• Lead cross-functional triage discussions and guide strategies for containment and eradication.

• Coordinate forensic investigations and facilitate postmortem reviews.

• Analyze multi-source telemetry using enterprise Security Information and Event Management (SIEM) systems and endpoint auditing tools.

• Identify adversary tactics mapped to the MITRE ATT&CK framework.

• Conduct hypothesis-driven threat hunts.

• Transform findings from threat hunts into automated detections and alerting protocols.

• Collaborate with governance teams to gather, validate, and orchestrate technical control evidence for compliance audits.

• Design automated workflows, runbooks, and Python scripts to streamline operations and reduce technical debt.

• Utilize AI/LLM tools and REST APIs to enhance triage workflows and improve threat analysis.

⛳️ Requirements

• Minimum of 4 years of practical experience in a dedicated Security Operations Center, Cloud Security, or Incident Response role in a modern enterprise setting.

• Proficiency with AWS, Azure, and GCP cloud architectures.

• Experience in managing the vulnerability lifecycle and operating/tuning vulnerability management processes.

• Familiarity with CVSS and EPSS scoring methodologies.

• Proven ability to drive remediation in complex microservice environments.

• Experience managing high-pressure incident response processes in accordance with NIST SP 800-61 / ISO standards.

• Skilled in querying, correlating, and interpreting security logs from enterprise SIEM platforms, including Splunk, and Linux system logs.

• Competence in authoring postmortems and Standard Operating Procedures (SOPs).

• Experience utilizing AI/LLMs for alert enrichment, ticket categorization, or operational automation.

• Bachelor's degree in Cybersecurity, Information Systems, or equivalent experience (preferred).

• Proficient in Python automation and scripting.

• Knowledge of physical data center security.

• Experience with REST APIs, including those from Jira, GitHub, and cloud services.

• Familiarity with Kubernetes and container security scanners, such as Wiz or Falco.

• Possession of industry-recognized certifications like CISSP, AWS Certified Security – Specialty, GIAC (GCIH/GCFA/GCDA), or Splunk Core Certified Power User/Admin.

• Willingness and availability to participate in a distributed team on-call rotation.

🏝️ Benefits

• Medical, dental, and vision insurance.

• 401(k) plan with a matching contribution from Cisco.

• Paid parental leave.

• Coverage for short- and long-term disabilities.

• Basic life insurance coverage.

• Potential for Cisco restricted stock unit grants.

• 10 paid holidays each full calendar year.

• 1 floating holiday available for non-exempt employees.

• 1 paid day off to celebrate the employee’s birthday.

• Paid holiday shutdown at the end of the year.

• 4 paid days off designated for personal wellness.

• 16 days of paid vacation annually for non-exempt employees.

• Flexible vacation time off program with no specified limit for eligible exempt employees.

• 80 hours of sick leave provided on the hire date and each January 1st thereafter.

• Up to 80 hours of unused sick leave can be carried forward.

• Additional paid time off for critical or emergency family matters.

• Option for 10 paid volunteer days each year.

• Annual bonuses for non-sales positions, in line with Cisco policies.

• Opportunities for continuous learning, mentorship, and career advancement.