Hybrid Senior Cybersecurity Operations Lead (SIEM & IR)

University of Colorado System; Allenspark (CO); Hybrid; USD 100,000 - 110,000; Full time

Job summary

University of Colorado Boulder is seeking a Senior Cybersecurity Operations Engineer to lead incident response and detection engineering within the Security Operations team. The role focuses on monitoring, alerting, and improving threat detection across endpoint, network, and cloud environments.

The engineer will own SIEM and related monitoring capabilities, develop detections, and automate response workflows while collaborating with campus IT, system owners, and partners.

Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, engineering, or a related field.
• At least 3 years of progressively responsible experience in cybersecurity operations, incident response, detection engineering, security monitoring, or related areas.
• Experience investigating cybersecurity events using telemetry from endpoint, network, email, identity, cloud, or SIEM.

Responsibilities

• Lead or coordinate cybersecurity incident responses from identification through containment and recovery.
• Own SIEM and monitoring capabilities, including log onboarding, data routing, parsing, enrichment, and health.
• Develop and tune detections across endpoint, network, email, identity, cloud, and applications.
• Create dashboards, alerts, and reports to support monitoring and leadership awareness.
• Mentor colleagues and student employees as assigned.

Skills

Incident response

Detection engineering

SIEM

Security monitoring

Automation

Education

Bachelor’s degree in cybersecurity or related field

Tools

SIEM

EDR/XDR

Job description

University of Colorado Boulder is seeking a Senior Cybersecurity Operations Engineer to lead incident response and detection engineering within the Security Operations team. The role focuses on monitoring, alerting, and improving threat detection across endpoint, network, and cloud environments.

The engineer will own SIEM and related monitoring capabilities, develop detections, and automate response workflows while collaborating with campus IT, system owners, and partners.