Principal Security Architect - Cyber Operations and Incident Response

City of Hope; United States; On-site; USD 140,000 - 180,000; Full time

Job summary

City of Hope is seeking a Principal Security Architect to lead enterprise detection, monitoring, and incident response programs across clinical, research, and technology environments. The role defines security architecture, standards, and capabilities for SIEM, SOAR, UEBA, threat intelligence, and cyber defense.

You will collaborate with SOC and cross-functional teams to ensure actionable telemetry, rapid investigations, and measurable risk reduction, while guiding governance, risk, and

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, MIS or related field.
• Nine+ years of cybersecurity experience with depth in security architecture or security engineering.
• Experience designing security controls across complex multi-vendor environments.
• Preferred Master’s degree in cybersecurity or related technology field.
• Certifications such as CISSP, GCIH, GCFA, GCIA, GMON, GNFA, GCFE, GRID, SC-200 or equivalent.

Responsibilities

• Define and maintain enterprise architecture, standards, and roadmaps for SOC operations, SIEM, SOAR, UEBA, threat intelligence, digital forensics, incident response, and cyber defense platforms.
• Lead design and optimization of enterprise detection engineering programs, security monitoring capabilities, threat hunting frameworks, use-case development, and adversary detection strategies aligned with MITRE ATT&CK and industry best practices.
• Architect and enhance incident response, forensic investigation, cyber resilience, ransomware recovery, and crisis management capabilities across enterprise environments.
• Lead assessment and improvement of security telemetry, log management, detection coverage, alert fidelity, incident workflows, automation opportunities, and response processes.
• Partner with security engineering teams to ensure security technologies generate adequate logging, visibility, and actionable telemetry to support detection and response objectives.
• Provide strategic leadership and technical guidance to SOC analysts, incident responders, threat hunters, detection engineers, and management teams. Develop documentation, standards, executive metrics, and board-level reporting.
• Evaluate emerging threats, adversary techniques, AI-assisted attack methods, security operations technologies, and threat intelligence capabilities to enhance organizational cyber defense effectiveness.
• Follows established City of Hope and department policies, procedures, objectives, performance improvement, attendance, safety, environmental, and infection control guidelines, including adherence to the workplace code of Conduct and Compliance Plan.
• Practices a high level of integrity and honesty in maintaining confidentiality.
• Performs other related duties as assigned or requested.

Skills

SOC leadership

Incident response

Detection engineering

Threat intelligence

MITRE ATT&CK

Threat hunting

Automation opportunities

Log management

Security telemetry

Education

Bachelor’s degree in Computer Science or related field

Master’s degree in Cybersecurity or related field

Tools

CISSP

GCIH

GCFA

GCIA

GMON

GNFA

GCFE

GRID

SC-200

Job description

Your qualifications should include:

Join the transformative team at City of Hope, where we're changing lives and making a real difference in the fight against cancer, diabetes, and other life-threatening illnesses. City of Hope’s growing national system includes its Los Angeles campus, a network of clinical care locations across Southern California, a new cancer center in Orange County, California, and treatment facilities in Atlanta, Chicago and Phoenix. Our dedicated and compassionate employees are driven by a common mission: To deliver the cures of tomorrow to the people who need them today.

Position Summary:

The Principal Security Architect, Cyber Operations and Incident Response serves as the senior technical authority responsible for the architecture, design, and continuous improvement of enterprise detection, monitoring, threat detection, incident response, and cyber defense capabilities. This role establishes security monitoring strategies, incident response architectures, detection engineering standards, threat intelligence integration, and cyber resilience capabilities that protect clinical, research, business, and technology environments.

The position partners closely with SOC leadership, Incident Response teams, Threat Intelligence, Infrastructure, Identity, Cloud, and Engineering teams to ensure cybersecurity controls generate actionable visibility, effective detection coverage, rapid response capabilities, and measurable risk reduction across enterprise environments.

As a successful candidate, you will:

• Define and maintain enterprise architecture, standards, and roadmaps for SOC operations, SIEM, SOAR, UEBA, threat intelligence, digital forensics, incident response, and cyber defense platforms.
• Lead the design and optimization of enterprise detection engineering programs, security monitoring capabilities, threat hunting frameworks, use-case development, and adversary detection strategies aligned with MITRE ATT&CK and industry best practices.
• Architect and enhance incident response, forensic investigation, cyber resilience, ransomware recovery, and crisis management capabilities across enterprise environments.
• Lead assessment and improvement of security telemetry, log management, detection coverage, alert fidelity, incident workflows, automation opportunities, and response processes.
• Partner with security engineering teams to ensure security technologies generate adequate logging, visibility, and actionable telemetry to support detection and response objectives.
• Provide strategic leadership and technical guidance to SOC analysts, incident responders, threat hunters, detection engineers, and management teams. Develop documentation, standards, executive metrics, and board-level reporting.
• Evaluate emerging threats, adversary techniques, AI-assisted attack methods, security operations technologies, and threat intelligence capabilities to enhance organizational cyber defense effectiveness.
• Follows established City of Hope and department policies, procedures, objectives, performance improvement, attendance, safety, environmental, and infection control guidelines, including adherence to the workplace code of Conduct and Compliance Plan.
• Practices a high level of integrity and honesty in maintaining confidentiality.
• Performs other related duties as assigned or requested.

Your qualifications should include:

Minimum Education:

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Management Information Systems, Computer Information Systems, Computer or Electrical Engineering, or a related field.

OR

Minimum Experience:

• Nine years or more of progressive cybersecurity experience with significant depth in security architecture, security engineering, or both; or a master’s degree and seven years of relevant experience.
• Demonstrated experience designing security controls across complex, multi-vendor enterprise environments and applying risk analysis, risk assessment, and risk management practices

Preferred Education:

• Master’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or another technology-related field

Pref. Certification/Licensure:

• CISSP, GCIH, GCFA, GCIA, GMON, GNFA, GCFE, GRID, SC-200, or equivalent advanced security operations and incident response certifications.

Preferred Experience:

• Leadership of enterprise SOC, incident response, detection engineering, or cyber defense programs.
• Deployment and optimization of SIEM, SOAR, UEBA, NDR, EDR/XDR, and threat intelligence platforms.
• Threat hunting, adversary emulation, digital forensics, and malware analysis programs.
• Cybersecurity operations within healthcare, life sciences, or another highly regulated industry.
• Managed SOC providers, co-sourced security operations, and security service governance.
• Security metrics, detection maturity assessments, and cyber resilience program development.

City of Hope employees pay is based on the following criteria: work experience, qualifications, and work location.

City of Hope is an equal opportunity employer.