SecOps Engineer: Threat Hunting & Incident Response

Cisco; Durham (NC); On-site; USD 120,000 - 170,000; Full time

Job summary

Cisco's Security Business Group (SBG) SecOps team is seeking a seasoned security operations professional to join a frontline defense role. You will work with security engineers, researchers, and developers in a collaborative, high-impact environment, applying automation and AI tools to accelerate triage and detection.

You will lead vulnerability management, incident response, threat hunting, and compliance activities across cloud and on-prem environments, leveraging SIEMs like Splunk and REST

Qualifications

• 4+ years in a dedicated SOC, Cloud Security, or Incident Response role in a modern enterprise.
• Experience with cloud architecture (AWS, Azure, GCP).
• Experience with vulnerability lifecycle management, CVSS/EPSS, and remediation across microservices.
• Experience in incident response following NIST SP 800-61 / ISO standards.
• Experience with log/telemetry analysis in enterprise SIEM (Splunk) and Linux logs.
• Experience authoring postmortems and SOPs; strong written/verbal communication.
• Experience leveraging AI/LLMs for alert enrichment and automation.

Responsibilities

• Manage, triage, and validate findings across enterprise scanners (containers, hosts, cloud).
• Prioritize vulnerabilities, validate false positives, enforce remediation SLAs.
• Act as Incident Commander during high-severity Cisco SecOps incidents.
• Lead cross-functional triage calls; coordinate containment, eradication, and postmortems.
• Analyze telemetry to detect threats mapped to MITRE ATT&CK; develop automations and detections.

Skills

SOC experience

Cloud Security

Vulnerability management

Incident response

SIEM analysis

Postmortems & SOPs

AI/LLM automation

Education

Bachelor's degree in Cybersecurity or related

Tools

Python

Kubernetes

Wiz

Falco

Splunk

Jira

GitHub

REST APIs

Job description

Cisco's Security Business Group (SBG) SecOps team is seeking a seasoned security operations professional to join a frontline defense role. You will work with security engineers, researchers, and developers in a collaborative, high-impact environment, applying automation and AI tools to accelerate triage and detection.

You will lead vulnerability management, incident response, threat hunting, and compliance activities across cloud and on-prem environments, leveraging SIEMs like Splunk and REST