Principal Security Operations Engineer

StratITech; Phoenix (AZ); On-site; USD 150,000 - 195,000; Full time

Job summary

StratITech is seeking a Principal Security Operations Engineer to lead cybersecurity incident response, security operations, and advanced investigations across a distributed enterprise. This leader will own high-severity incidents, work across firewalls, DNS, AD, cloud logs, and SIEM pipelines, and guide teams while remaining hands-on.

The role emphasizes technical credibility, mentorship, and continuous improvement of incident response practices, with collaboration across infrastructure,

Qualifications

• Senior-level experience in cybersecurity incident response or security operations.
• Experience as Incident Commander or lead for high-severity incidents.
• Ability to own and drive incidents from triage to remediation and post-incident review.
• Strong understanding of TCP/IP, firewall state tables, NAT, and network security events.
• Experience with DNS-based threats, DNS logs, and passive DNS.
• Strong Active Directory security knowledge and compromise response.

Responsibilities

• Own incident response for high-severity incidents from triage to containment and recovery.
• Validate escalations and determine true compromise vs. false positives.
• Investigate incidents across firewall, DNS, AD, cloud, and SIEM logs.
• Lead infrastructure-level security investigations and coordinate containment.
• Mentor colleagues and provide technical direction during investigations.
• Improve incident response processes, runbooks, and post-incident reviews.
• Collaborate with cross-functional teams to verify remediation and scope.

Skills

Incident Commander

Incident Response

SOC escalation

TCP/IP fundamentals

DNS security

Active Directory security

SIEM/logging

Mentoring

Tools

Splunk

Palo Alto

Fortinet

Check Point

Cisco

EDR/XDR platforms

Job description

Location: Walnut Creek, CA; Phoenix, AZ; or Honolulu, HI

Employment Type: Full-Time, Direct Hire

Compensation:

Walnut Creek or Honolulu- DOE 160-195k

Phoenix- DOE 150-175k

About the Role

We are seeking a Principal Security Operations Engineer to serve as a senior technical leader for cybersecurity incident response, security operations, and infrastructure-level investigation across a complex, distributed enterprise environment.

This is not a traditional SOC analyst role or a people-management position. The right candidate will take ownership of high-severity cybersecurity incidents while going deep technically across firewalls, DNS, Active Directory, endpoint telemetry, cloud logs, SIEM/logging pipelines, and network security infrastructure.

Working closely with the Senior Manager, this individual will provide technical leadership, mentorship, and guidance to the team while maintaining hands‑on responsibility for complex investigations and incident response activities.

The organization uses external monitoring and managed detection support for initial alerting. Escalated events require an experienced technical leader who can validate the signal, determine scope, coordinate containment, guide technical teams, communicate risk to leadership, and drive incidents through remediation, root-cause analysis, and post-incident improvement.

What You'll Do

• Own incident response for high-severity cybersecurity incidents, serving as Incident Commander from initial triage through containment, remediation, recovery, root-cause analysis, and post-incident review.
• Validate escalations from managed detection providers and determine whether suspicious activity represents true compromise, false positive, misconfiguration, or business-approved behavior.
• Investigate incidents across firewall logs, DNS logs, endpoint telemetry, Active Directory events, cloud audit logs, SIEM data, vulnerability data, and third‑party security alerts.
• Lead infrastructure‑level security investigations involving TCP/IP traffic, firewall state tables, NAT, epithelial ports, DNS forwarding, suspicious authentication, anomalous cloud activity, endpoint compromise, and Active Directory risk.
• Partner with the Senior Manager and infrastructure, network, endpoint, cloud, and application teams to determine scope, implement containment, confirm root cause, and verify remediation.
• Serve as a senior technical resource and mentor, providing guidance, knowledge sharing, and technical direction to colleagues during complex investigations and security incidents.
• Drive improvements to incident response processes, escalation paths, runbooks, tabletop exercises, communication templates, and post-incident review practices.
• Help improve asset visibility by correlating data from Active Directory, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB sources, and network telemetry.
• Communicate clearly with technical teams, executives, legal/compliance stakeholders, and external partners during active incidents.

Required Experience

• Senior‑level experience in cybersecurity incident response, security operations, cyber defense, or principal‑level security engineering.
• Demonstrated experience serving as an Incident Commander, Incident Response Lead, SOC escalation leader, or senior incident owner for high‑severity cybersecurity incidents.
• Proven ability to personally own and drive incidents from initial triage through containment, remediation, root‑cause analysis, post‑incident review, and operational improvement.
• Strong understanding of TCP/IP fundamentals, including source/destination ports, epithelial ports, NAT, firewall state tables, and stateful inspection.
• Ability to interpret firewall logs, connection logs, NAT behavior, blocked/allowed traffic, and network security events during an investigation.
• Experience investigating DNS‑based threats, including DGA alerts, suspicious domain activity, DNS forwarding, passive DNS, DNS server logs, and identifying the originating host behind suspicious DNS requests.
• Strong understanding of Active Directory security and compromise response, including administrator workstation compromise, credential exposure, lateral movement risk, Tier 0 assets, and domain controller investigation.
• Experience with SIEM/logging architecture and troubleshooting, ideally Splunk or a comparable platform.
• Understanding of syslog limitations and log transport challenges, including UDP syslog, packet loss, TCP syslog, buffering, spooling, and store‑and‑forward logging designs.
• Experience validating asset inventory and exposure using sources such as AD, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB records, and network telemetry.
• Ability to provide technical leadership, collaborate across teams, and mentor colleagues without formal people‑management responsibilities.
• Strong communication skills with the ability to brief executives, coordinate technical teams, and communicate business risk during active security incidents.

These Skills Are a Plus

• Experience in transportation, logistics, maritime, shipping, industrial, critical infrastructure, or other distributed operational environments.
• Experience supporting remote offices, branch networks, ships, satellite links, or high‑latency / low‑reliability network environments.
• Experience with Splunk architecture, including Universal Forwarders, indexers, search heads, CIM normalization, indexer acknowledgment, queue troubleshooting, and Splunk internal logs.
• Experience with Palo Alto, Fortinet, Check Point, Cisco, or similar firewall and network security platforms.
• Experience with Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, or other EDR/XDR platforms.
• Digital forensics experience across endpoint, network, cloud, identity, or email investigations.
• Experience with ransomware, business email compromise, credential theft, Mimikatz, lateral movement, suspicious authentication, cloud account compromise, or third‑party compromise scenarios.
• Experience working with MDR/MSSP providers such as ReliaQuest or similar managed detection partners.

What Success Looks Like

The right person can take a vague or incomplete security signal, determine whether it matters, identify what data is missing, pull in the right teams, make containment recommendations, communicate clearly, and drive the incident to closure.

Success requires calm incident leadership, hands‑on technical credibility, and a genuine commitment to remaining engaged in complex security engineering work.

This individual will be a trusted technical partner to the Senior Manager, providing mentorship and guidance to colleagues while taking direct ownership of critical security incidents.

The focus is on technical expertise, accountability, collaboration, and continuous improvement—not formal people management.