Principal, SOC Analyst

Wis Phys Svc Ins Corp; Madison (WI); Hybrid; USD 125.000 - 160.000; Vollzeit

Benefits dieser Stelle

Performance bonus

401(k) with matching

Health insurance

Dental insurance

Paid time off

Professional development programs

Zusammenfassung

Wisconsin Physicians Service Insurance Corp (WPS) is seeking a Principal, Security Operations Center Analyst to lead threat detection, investigation, and response across government and commercial environments. You will design threat-informed detections, mentor SOC analysts, and drive SIEM modernization in partnership with CTM and IT teams.

The role requires US citizenship, 7+ years in cybersecurity, and a hands-on mastery of MITRE ATT&CK-aligned detections, incident response, and security

Qualifikationen

• U.S. citizenship is required for this position due to Department of Defense restrictions.
• Bachelor's degree in computer science, Cybersecurity, Information Technology, or related field, or equivalent education and/or relevant work experience
• 7 or more years of progressive cybersecurity experience.
• 5 or years in security operations, incident response, and/or detection engineering.
• Extensive experience architecting and governing detection engineering and SIEM operations (Azure Sentinel and/or Splunk), including building, tuning, and measuring detections using MITRE ATT&CK.
• Extensive experience leading incident response using a recognized framework (NIST 800-61), including managing complex identity, endpoint, email, and cloud incidents and communicating clearly during high impact events.
• Proficient understanding of cloud, identity, and endpoint security telemetry across Azure, Entra ID, Microsoft 365, AWS, and EDR/XDR tools (e.g., Microsoft Defender XDR or CrowdStrike Falcon).
• Proficient skills in security automation, including scripting (Python or PowerShell), SOAR playbook development, and applying AI to SOC triage and investigation.
• Proficient in applying federal and healthcare security standards (e.g., NIST 800-53, NIST CSF, CMS ARS, CMMC, HIPAA) to security operations.
• Strong communication, collaboration and relationship management skills.
• Ability to influence without authority and communicate technical concepts to both technical and non-technical audiences.
• Strong analytical, organizational, and project management skills, with the ability to drive initiatives independently.

Aufgaben

• Design threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external-facing applications.
• Lead significant security incidents through all phases, including detection, analysis, containment, eradication, recovery, and post-incident review.
• Govern detections as code and lead SIEM migration content and log sources.
• Architect SOC monitoring model and detection architecture for network environments and ensure log source coverage and data quality.
• Conduct hypothesis-driven threat hunting and translate results into new detections.
• Operationalize threat intelligence reporting to prioritize detections, hunts, and vulnerability response.
• Build and maintain automation, orchestration, and AI-assisted workflows to streamline alert triage and investigations.
• Mentor SOC analysts and provide coaching.
• Author and govern SOC SOPs, playbooks, and runbooks; support audits, assessments, and vendor engagements.
• Collaborate with partner teams to embed detection requirements into new systems and projects.

Kenntnisse

Threat hunting

Incident response

Threat intelligence

Security automation

Scripting (Python/PowerShell)

SOAR playbooks

MITRE ATT&CK framework

SIEM operations (Sentinel, Splunk)

Cloud security

Communication

Mentorship

Project management

Ausbildung

Bachelor's degree in computer science, Cybersecurity, Information Technology, or related field

Tools

Azure Sentinel

Splunk

Microsoft Defender XDR

CrowdStrike Falcon

PowerShell

Python

Jobbeschreibung

U.S. citizenship is required for this position due to Department of Defense restrictions.

Our Principal, Security Operations Center (SOC) Analyst serves as the senior technical leader for detecting, investigating, and responding to cyber threats across WPS’s Government and Commercial environments. This Analyst designs threat‑informed detections, leads major incident response efforts from first alert through recovery. They drive the modernization of our core detection and response capabilities, this includes: SIEM, threat hunting, threat intelligence, and security automation. Our Principal SOC Analyst is positioned within Cyber Threat Management (CTM), and report to our Manager, CTM, they closely partner with Application Security, Cyber Trust & Architecture, Cyber Risk & Assurance, IT Infrastructure, and IT Application Engineering. This Principal-level role will not have direct reports, but will want to and enjoy mentoring SOC analysts, producing the metrics and evidence that leadership uses to demonstrate operating effectiveness and reductions in cyber risk.

Salary Range $125,000 ~ $160,000 The base pay offered for this position may vary within the posted range based on your job-related knowledge, skills, and experience. Work Location Our first consideration will be to have this employee be able to take advantage of Hybrid work and collaboration, living within the state of Wisconsin. Employees within 45 miles of WPS Headquarters (1717 W. Broadway in Madison, WI, 53713) will be expected to be able to work in office 3 days a week on a regular basis.

How do I know this opportunity is right for me? If you:

• Can design, build, test, and tune threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external‑facing applications; govern detections as code; and serve as the technical lead for SIEM migration detection content and log sources.
• Have led significant security incidents through all phases, including detection, analysis, containment, eradication, recovery, and post‑incident review; maintain and improve incident response playbooks (including ransomware readiness), support required federal and contractual reporting in partnership with Legal, Privacy, and Compliance, orchestrate tabletop and recovery exercises, and participate in on‑call escalation.
• Enjoy defining and architecting the SOC monitoring model and detection architecture for both network environments, preserving data isolation and the regulatory boundaries between them; govern log‑source coverage and data quality against the enterprise asset inventory; and ensure managed service providers meet service levels for log delivery, alert handling, and containment.
• Want to conduct hypothesis‑driven threat hunting activities and translate results into new detections; operationalize threat‑intelligence reporting to prioritize detections, hunts, and vulnerability response; and validate detection effectiveness through adversary‑simulation and purple‑team exercises.
• Like to build and maintain automation, orchestration, and AI‑assisted workflows to streamline alert triage and investigations; govern and communicate key SOC performance metrics that include:
  • Detection coverage, detection and response times, alert quality, and automation rates that support business reviews and executive risk reporting.
• Love providing mentorship and coaching to SOC analysts.
• Can author and govern SOC standard operating procedures, playbooks, and runbooks; represent detection and response in audits, assessments, and vendor engagements, providing operating‑effectiveness evidence from day‑to‑day operations.
• Enjoy working with partner teams to build detection and response requirements into new systems and projects.

Minimum Qualifications

• U.S. citizenship is required for this position due to Department of Defense restrictions.
• Bachelor's degree in computer science, Cybersecurity, Information Technology, or related field, or equivalent education and/or relevant work experience
• 7 or more years of progressive cybersecurity experience.
• 5 or years in security operations, incident response, and/or detection engineering.
• Extensive experience architecting and governing detection engineering and SIEM operations (Sentinel/KQL and/or Splunk/SPL), including building, tuning, and measuring detections using the MITRE ATT&CK framework.
• Extensive experience leading incident response using a recognized framework (such as NIST 800‑61), including managing complex identity, endpoint, email, and cloud incidents and communicating clearly during high impact events.
• Proficient understanding of cloud, identity, and endpoint security telemetry across Azure, Entra ID, Microsoft 365, AWS, and EDR/XDR tools (e.g., Microsoft Defender XDR or CrowdStrike Falcon).
• Proficient skills in security automation, including scripting (Python or PowerShell), SOAR playbook development, and applying AI to SOC triage and investigation.
• Proficient in applying federal and healthcare security standards (e.g., NIST 800‑53, NIST CSF, CMS ARS, CMMC, HIPAA) to security operations.
• Strong communication, collaboration and relationship management skills.
• Ability to influence without authority and communicate technical concepts to both technical and non‑technical audiences.
• Strong analytical, organizational, and project management skills, with the ability to drive initiatives independently.

Preferred Qualifications

• Experience working on federal contracts in a highly security conscious environment.
• Industry certifications could include: CISSP, CCSP, or CISM.

Remote Work Requirements

• High speed cable or fiber
• Minimum of 10 Mbps downstream and at least 1 Mbps upstream internet connection (can be checked at https://speedtest.net ).
• Remote and hybrid work options available
• Performance bonus and/or merit increase opportunities
• 401(k) with a 100% match for the first 3% of your salary and a 50% match for the next 2% of your salary (100% vested immediately)
• Competitive paid time off
• Health insurance, dental insurance, and telehealth services start DAY 1
• Professional and Leadership Development Programs

WPS, a health solutions company, is a leading not-for-profit health insurer and federal government contractor headquartered in Madison, Wisconsin. WPS offers health insurance plans for individuals, families, seniors and group health plans for small to large businesses. We process claims and provide customer support for beneficiaries of the Medicare program and manage benefits for millions of active‑dut y and retired military personnel across the U.S. and abroad. WPS has been making healthcare easier for the people we serve for nearly 80 years . Proud to be military and veteran ready.

Culture Drives Our Success

WPS’ culture is where the great work and innovations of our people are seen, fueled and rewarded. We accomplish this by creating an open and empowering employee experience. We recognize the benefits of employee engagement as an investment in our workforce—both current and future—to effectively seek, leverage, and include differing and unique perspectives that fuel agility and innovation on high-performing teams. This results in people bringing their authentic selves to work every day in an organization that successfully adapts to business changes and new opportunities.

This position may from time to time provide support to federal health care programs andother governmental or regulated industries. In accordance with law and/or contractual requirements, individuals in this role are or may be subject to all applicable federal regulations, agency contract requirements, and WPS internal policies, including but not limited to standards for data security, privacy, confidentiality, and program integrity. WPS and its personnel are subject to mandatory enhanced screening and background investigation prior to being granted access to information systems and/or sensitive data in order to safeguard regulated information and government resources that provide critical services.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.