Cloud Security Ops Lead: AWS, SIEM & Incident Response

Cherokee Federal; Almont (CO); On-site; USD 165,000 - 170,000; Full time

Benefits offered by this job

Medical, Dental, Vision

401K

Other benefits as provided

Job summary

Criterion Systems, LLC, a Cherokee Federal company, seeks a Senior Cloud Technical PM/Senior Cloud Security Operations Lead to secure NSF cloud environments and advance security maturity across SIEM, CSPM, and incident response.

You will own Splunk ES content, Prisma Cloud outcomes, and AWS logging integration, while guiding a team of analysts and engineers. Collaboration with platform, network, and application teams is essential to enforce least privilege, encryption, and secure configurations.

Qualifications

• 7+ years of experience in cybersecurity, cloud security, or security operations, including 3+ years leading technical teams.
• Hands-on experience securing and operating production cloud environments (AWS/Azure; GCP acceptable).
• Strong experience with SIEM operations, log onboarding, correlation rules, alert tuning, and investigative workflows.
• Experience with cloud incident response, including evidence handling and root-cause analysis.
• Working knowledge of cloud IAM, networking, encryption, key management, and secure service configurations.
• Experience with vulnerability management tools and coordinating remediation across engineering teams.

Responsibilities

• Lead cloud security operations for NSF AWS environments, including triage, investigation, containment, and recovery.
• Own Splunk Enterprise Security content and operations, including CIM alignment, correlation searches, and reporting.
• Own Prisma Cloud CSPM outcomes, including posture baselines, policy standards, and remediation workflows.
• Engineer and mature AWS logging and detection coverage; integrate CloudTrail, VPC Flow Logs, Route 53 Resolver logs, ALB/ELB logs, AWS Config, CloudWatch, GuardDuty, and Security Hub into Splunk ES and Prisma Cloud.
• Lead detection engineering mapped to MITRE ATT&CK; improve detection fidelity and reduce false positives.
• Define and execute AWS incident response playbooks and escalation paths; ensure evidence capture and post-incident actions.
• Drive continuous monitoring and compliance with FISMA and NIST 800-53; support audits with evidence packages.
• Partner with cloud platform, network, and application teams to enforce guardrails (IAM least privilege, MFA, KMS, segmentation, centralized logging).
• Prioritize remediation of misconfigurations and security findings; automate workflows where possible.

Skills

AWS/Azure security experience

SIEM operations

Incident response

Detection engineering

Cloud security operations

Leadership

Public Trust

Strong communication

Education

Bachelor's degree in a related field

Tools

Splunk ES

Prisma Cloud

AWS Config

CloudTrail

VPC Flow Logs

CloudWatch

GuardDuty

Security Hub

Job description

Criterion Systems, LLC, a Cherokee Federal company, seeks a Senior Cloud Technical PM/Senior Cloud Security Operations Lead to secure NSF cloud environments and advance security maturity across SIEM, CSPM, and incident response.

You will own Splunk ES content, Prisma Cloud outcomes, and AWS logging integration, while guiding a team of analysts and engineers. Collaboration with platform, network, and application teams is essential to enforce least privilege, encryption, and secure configurations.