Senior Principal Information Security Analyst – Defensive Operations

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the availability, performance, and data quality of the SIEM and log collection infrastructure.

• Lead a team that supports the Security Monitoring function.

• Develop and maintain the Splunk log ingestion pipeline, RBAC, searches, reporting, and dashboards.

• Assist systems that integrate with the SIEM platform.

• Guide a diverse team of employees and vendor staff in a player-coach capacity.

• Serve as the escalation point for monitoring platforms and security incidents.

• Anticipate data growth and manage ingestion and compute within licensed limits.

• Generate metrics, performance reports, and dashboards for leadership.

• Implement ITIL practices for incident, request, and change management.

• Oversee vendor relationships and contracts, including SLAs, performance evaluations, and service review meetings.

• Delegate tasks to employees and external resources in alignment with shared strategy and objectives.

• Lead responses to audit inquiries related to monitoring systems and controls.

• Collaborate with stakeholders during cybersecurity incidents.

• Assist in the triage and escalation of security events and threats using SIEM data.

• Collaborate with engineering and architecture teams to define requirements and timelines.

• Execute projects that enhance security event collection, detection, analysis, correlation, and response.

• Advise infrastructure and security teams on configuration modifications that enhance event collection.

• Monitor emerging trends in AI, machine learning, and analytics for security monitoring.

• Align the team with both short- and long-term goals, provide necessary tools, eliminate obstacles, and offer performance feedback.

• Clarify complex technical subjects to non-technical stakeholders.

⛳️ Requirements

• Over 10 years of experience in IT, with at least 5 years in security operations or as a monitoring system manager or lead engineer.

• More than 5 years of experience leading or directing technical teams, including contract staff.

• Expert-level proficiency in Splunk; must hold a Splunk Certified Consultant designation or demonstrate equivalent expertise.

• Advanced skills in Red Hat Linux.

• Proficiency in scripting with Python and Bash.

• Extensive experience with rsyslog configuration.

• Proven experience writing technical requirements and collaborating with engineering teams to implement them.

• Strong communication skills, both written and verbal, with the ability to build relationships and present to a range of audiences from engineers to executives.

• Sound judgment in assessing security controls against technical and administrative standards, making appropriate risk trade-offs.

• Experience with Splunk Enterprise Security and SOC operations, including the triaging of security incidents and threats.

• Background in overseeing managed service delivery and vendor SLAs.

• Familiarity with security telemetry sources such as syslog, Universal Forwarder and heavy forwarder deployments, Splunk DB Connect, and the VMware Data Collection Node.

• Knowledge of modern detection technologies (EDR/XDR) and cloud security logging.

• Experience in a large, complex organization, engaging across multiple business lines.

🏝️ Benefits

• Annual bonuses or other incentive plans.

• Equity awards.

• Pension or retirement benefits.

• 401(k) company match.

• Health and wellness programs.

• Fitness centers.

• Medical, dental, vision, life, and disability insurance benefits.

• Paid time off.

• Family support benefits.

• Reasonable accommodations during the recruitment process when required.

• Opportunities to speak at industry conferences.