IT Principal SOC Engineer (Must Reside in Texas)

Randolph-Brooks Federal Credit Union; San Antonio (TX); Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical benefits

401(k) matching

Tuition reimbursement

Paid time off

Job summary

Randolph-Brooks Federal Credit Union seeks a Principal SOC Engineer to shape security monitoring, detection, threat hunting, and incident response across hybrid infrastructure and cloud environments. You will guide architecture and strategy, influence senior leaders, and mentor engineers in a dynamic IT Security team.

You’ll lead high‑impact investigations, develop scalable SIEM/XDR/SOAR solutions, and align security controls with business risk while ensuring operational resilience during

Qualifications

• Bachelor’s degree in IT security or related field; four years of related experience may substitute.
• Minimum 5 years in cybersecurity, information security, cyber defense, or related discipline.
• Proven mastery of incident investigation, detection engineering, threat hunting, telemetry architecture, analytics, automation, and enterprise risk communication.

Responsibilities

• Define multi-year security strategy and target architecture for enterprise operations.
• Lead on high-impact security incidents and complex investigations.
• Establish telemetry onboarding, data quality, detection engineering, alert triage, and incident response processes.
• Architect scalable security data, SIEM, XDR, SOAR, and case-management capabilities.
• Define detection coverage models mapped to threats and critical assets.
• Sponsor cross-functional programs addressing cloud, identity, data, AI, and third‑party risks.
• Provide guidance for executive decisions, acquisitions, and strategic security investments.
• Measure telemetry health, coverage, precision, response speed, and risk reduction.
• Influence leadership to prioritize durable improvements in detection and response.

Skills

Security operations

Incident response

Threat hunting

Telemetry architecture

Automation

Cloud detection

Leadership

Education

Bachelor’s degree in IT security or related field

Four years of related experience in lieu of degree

Tools

SIEM

XDR

SOAR

Threat intelligence platforms

Job description

Principal SOC Engineer

Job Description and Requirements Randolph-Brooks Federal Credit Union is currently searching for an experienced and talented Principal SOC Engineer to join our amazing IT Security team! The Principal SOC Engineer will have the ability to work a hybrid schedule (remote/onsite) after a period of training (time frame may vary).

Training will take place at the RBFCU Administrative Service Center: 1 Ikea-RBFCU Pkwy, Live Oak, Texas 78233.

All applicants must reside within the state of Texas and have the capability of performing all of the work from their home in Texas.

To successfully work from home, employees must have access to a minimum internet connection as noted by RBFCU. Must have a reliable home internet provider and the ability to hard wire a connection directly to modem (Ethernet cable provided). Must be able to provide a workspace at home that is safe, suitable for work, and within a distraction free environment.

The Principal Security Operations Center Engineer is an enterprise technical leader responsible for shaping the technical strategy, architecture, and evolution of security monitoring, detection, investigation, threat hunting, and incident response capabilities. The role defines how security telemetry, analytics, automation, intelligence, and response controls work together across hybrid infrastructure, cloud, identity, endpoint, network, applications, data platforms, and emerging technologies. The Principal Engineer leads the organization’s most consequential investigative and response decisions, anticipates adversary and technology changes, influences senior leaders, develops technical talent, and ensures that the SOC delivers measurable risk reduction, operational resilience, and trusted decision support during high-impact events.

Essential Functions and Responsibilities

• Define the multi-year technical strategy, target architecture, engineering principles, standards, and capability roadmap for enterprise security operations and detection and response.


• Lead or advise on the highest-impact, most ambiguous, or most technically complex security incidents, attack campaigns, forensic investigations, and enterprise response decisions.


• Establish enterprise methods for telemetry onboarding, data quality, detection engineering, threat hunting, alert triage, investigation, incident command, automation, evidence, and closure assurance.


• Architect scalable security data, SIEM, XDR, SOAR, case-management, threat intelligence, analytics, automation, and response-control capabilities across the enterprise.


• Define detection and response coverage models mapped to threat scenarios, attack paths, critical assets, business services, control dependencies, and acceptable residual risk.


• Anticipate emerging threats and sponsor cross-functional programs addressing cloud, identity, software supply chain, data, AI, insider, third‑party, and advanced persistent threat risks.


• Provide authoritative technical guidance for material incidents, executive decisions, acquisitions, major transformations, regulatory commitments, and strategic security investments.


• Define measurement frameworks connecting telemetry health, coverage, precision, response speed, containment effectiveness, automation, resilience, and incident outcomes to business risk.


• Influence executives and senior security, technology, legal, privacy, communications, risk, and business leaders to prioritize durable detection and response improvements.


• Develop senior technical talent through mentorship, architecture and detection reviews, exercises, communities of practice, succession planning, and external industry engagement.


• All other duties as assigned (note: essential functions and responsibilities may change or new ones may be assigned at any time with or without notice)

Requirements

• Bachelor’s degree in IT security or related fields.


• Four years of job-related experience in lieu of bachelor’s degree.


• Minimum 5 years of experience in cybersecurity, information security, cyber defense, security operations, incident response, threat intelligence, detection engineering, or related discipline.


• Demonstrated mastery of incident investigation and command, detection engineering, threat hunting, telemetry architecture, security analytics, automation, adversary behavior, and enterprise risk communication.


• Proven experience designing or materially influencing large‑scale SIEM, XDR, SOAR, security data, cloud detection, case-management, or response capabilities.


• Advanced software, automation, query, or data‑engineering capability and a strong record of designing maintainable detection, investigation, and response platforms.


• Ability to define strategy and standards while remaining sufficiently hands‑on to evaluate telemetry, review critical detections and code, guide prototypes, and investigate novel attack paths.


• Exceptional systems thinking and technical judgment, including the ability to make defensible decisions when evidence is incomplete and tradeoffs span security, safety, availability, legal, privacy, delivery, cost, and customer impact.


• Executive‑level written and verbal communication skills, with the ability to frame complex incident risk and uncertainty, build alignment, and influence investment and response decisions.


• Demonstrated leadership through influence, including mentoring senior engineers, resolving conflict, creating clarity in ambiguity, and sustaining multi‑year enterprise initiatives.


• High integrity, sound discretion, organizational awareness, composure under pressure, and a consistent record of accountability for enterprise outcomes.


• Experience defining enterprise detection and response architecture across multi‑cloud, identity, endpoint, network, application, data, operational technology, or AI environments.

Skills / Certification / Licensing

• Recognized enterprise authority integrating incident response, detection, hunting, telemetry, forensics, automation, cloud, identity, data, adversary intelligence, and risk.


• Defines strategic problems, creates technical direction, and operates with broad organizational trust and accountability.


• Resolves novel, high‑consequence, systemic security operations problems and establishes durable enterprise solutions.


• Shapes organization‑wide monitoring architecture, response practices, engineering standards, investments, and risk outcomes.


• Influences executives and senior technical, legal, privacy, risk, communications, and business leaders while reconciling competing priorities.


• Multiplies organizational capability through strategy, standards, mentorship, exercises, communities of practice, and technical stewardship.


• Delivers measurable improvements in detection coverage, investigative confidence, containment effectiveness, operational resilience, and enterprise risk reduction.

All qualified applicants will receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, or other legally protected status.

Careers at RBFCU

Established in 1952, Randolph-Brooks Federal Credit Union is a full-service financial cooperative whose mission is to improve members’ economic well‑being and quality of life. With assets exceeding $19.6 billion, RBFCU serves more than 1.1 million members at branches throughout Texas and Oklahoma, and online at rbfcu.org and the RBFCU Mobile® app. Recognized for financial stability, our credit union has consistently received the highest ratings of “Five Star” and “Superior” from respected organizations that evaluate financial institutions in the United States. We’re frequently recognized as one of the best workplaces on a local and national level.

Benefits

RBFCU is proud to offer a comprehensive benefits package, including:

• 401(k) with matching incentives — up to 10 percent


• Competitive pay


• Medical, vision and dental benefits available to employees and their families from the first day of employment


• Tuition reimbursement plans


• Life insurance


• Pharmacy discount programs


• Flexible Spending (FSA), Health Savings (HSA) and Dependent Care account options


• Paid time off


• Parental leave


• Company‑paid benefits include: Long‑term disability Basic life insurance Wellness program Credit‑monitoring service Employee assistance program Training and volunteer opportunities