Lead SOC Architect & Incident Response Strategist

Wis Phys Svc Ins Corp; Madison (WI); Hybrid; USD 125,000 - 160,000; Full time

Benefits offered by this job

Performance bonus

401(k) with matching

Health insurance

Dental insurance

Paid time off

Professional development programs

Job summary

Wisconsin Physicians Service Insurance Corp (WPS) is seeking a Principal, Security Operations Center Analyst to lead threat detection, investigation, and response across government and commercial environments. You will design threat-informed detections, mentor SOC analysts, and drive SIEM modernization in partnership with CTM and IT teams.

The role requires US citizenship, 7+ years in cybersecurity, and a hands-on mastery of MITRE ATT&CK-aligned detections, incident response, and security

Qualifications

• U.S. citizenship is required for this position due to Department of Defense restrictions.
• Bachelor's degree in computer science, Cybersecurity, Information Technology, or related field, or equivalent education and/or relevant work experience
• 7 or more years of progressive cybersecurity experience.
• 5 or years in security operations, incident response, and/or detection engineering.
• Extensive experience architecting and governing detection engineering and SIEM operations (Azure Sentinel and/or Splunk), including building, tuning, and measuring detections using MITRE ATT&CK.
• Extensive experience leading incident response using a recognized framework (NIST 800-61), including managing complex identity, endpoint, email, and cloud incidents and communicating clearly during high impact events.
• Proficient understanding of cloud, identity, and endpoint security telemetry across Azure, Entra ID, Microsoft 365, AWS, and EDR/XDR tools (e.g., Microsoft Defender XDR or CrowdStrike Falcon).
• Proficient skills in security automation, including scripting (Python or PowerShell), SOAR playbook development, and applying AI to SOC triage and investigation.
• Proficient in applying federal and healthcare security standards (e.g., NIST 800-53, NIST CSF, CMS ARS, CMMC, HIPAA) to security operations.
• Strong communication, collaboration and relationship management skills.
• Ability to influence without authority and communicate technical concepts to both technical and non-technical audiences.
• Strong analytical, organizational, and project management skills, with the ability to drive initiatives independently.

Responsibilities

• Design threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external-facing applications.
• Lead significant security incidents through all phases, including detection, analysis, containment, eradication, recovery, and post-incident review.
• Govern detections as code and lead SIEM migration content and log sources.
• Architect SOC monitoring model and detection architecture for network environments and ensure log source coverage and data quality.
• Conduct hypothesis-driven threat hunting and translate results into new detections.
• Operationalize threat intelligence reporting to prioritize detections, hunts, and vulnerability response.
• Build and maintain automation, orchestration, and AI-assisted workflows to streamline alert triage and investigations.
• Mentor SOC analysts and provide coaching.
• Author and govern SOC SOPs, playbooks, and runbooks; support audits, assessments, and vendor engagements.
• Collaborate with partner teams to embed detection requirements into new systems and projects.

Skills

Threat hunting

Incident response

Threat intelligence

Security automation

Scripting (Python/PowerShell)

SOAR playbooks

MITRE ATT&CK framework

SIEM operations (Sentinel, Splunk)

Cloud security

Communication

Mentorship

Project management

Education

Bachelor's degree in computer science, Cybersecurity, Information Technology, or related field

Tools

Azure Sentinel

Splunk

Microsoft Defender XDR

CrowdStrike Falcon

PowerShell

Python

Job description

Wisconsin Physicians Service Insurance Corp (WPS) is seeking a Principal, Security Operations Center Analyst to lead threat detection, investigation, and response across government and commercial environments. You will design threat-informed detections, mentor SOC analysts, and drive SIEM modernization in partnership with CTM and IT teams.

The role requires US citizenship, 7+ years in cybersecurity, and a hands-on mastery of MITRE ATT&CK-aligned detections, incident response, and security