Lead IT Security Analyst - Cloud Security & Incident Response

Western Governors University; Durham (NC); On-site; USD 161,000 - 250,000; Full time

Benefits offered by this job

Medical, dental, vision

Flexible PTO

Health savings account

Paid holidays

Parental leave

Job summary

Western Governors University seeks a lead-level security engineer to own complex incident response and threat detection across cloud and on-prem infrastructure. You will shape detections using MITRE ATT&CK, develop SOAR workflows, and mentor analysts in a fast-paced security operations team.

The role emphasizes hands-on, scripting-driven automation, CI/CD security, and deep cloud security expertise in AWS, with travel minimal and a strong emphasis on building scalable defenses.

Qualifications

• Bachelor's Degree in IT Security, Computer Science, Engineering, or related field.
• 7 years of Information Security experience, including understanding of all security domains.
• Hands-on experience implementing MITRE ATT&CK Framework.
• Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events.
• Hands-on experience maintaining cloud resources using infrastructure-as-code (CloudFormation, CDK, etc.).
• Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation.
• Experience with open-source security tools (i.e. Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, Eramba, etc).
• Hands-on experience with AWS APIs, Lambda. DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, IAM.
• Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.).
• Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services
• Hands-on experience integrating security into the various stages of a CI/CD pipeline
• Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions
• Ability to lead in a fast-paced, multidisciplinary environment while using a methodical, data-driven approach to security and risk analysis
• Excellent analytical, problem-solving, decision-making, and communication skills, with the ability to turn complex security challenges into practical solutions
• Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA

Responsibilities

• Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.
• Lead security content and detection use-case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.
• Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.
• Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
• Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.
• Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
• Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands-on guidance during demanding security situations.

Skills

MITRE ATT&CK

SIEM rules

Cloud security

Python scripting

CloudFormation/CDK

Automation scripting

AWS APIs

Education

Bachelor's Degree in IT Security/CS/Engineering

Tools

Kali

Nessus

Fortify

Burp Suite

NMap

Metasploit

Wireshark

Job description

Western Governors University seeks a lead-level security engineer to own complex incident response and threat detection across cloud and on-prem infrastructure. You will shape detections using MITRE ATT&CK, develop SOAR workflows, and mentor analysts in a fast-paced security operations team.

The role emphasizes hands-on, scripting-driven automation, CI/CD security, and deep cloud security expertise in AWS, with travel minimal and a strong emphasis on building scalable defenses.