Security Operations Analyst

Santa-Clara-University; Palo Alto (CA); Hybrid; USD 92,000 - 115,000; Full time

Job summary

Santa Clara University seeks a Security Operations Analyst to strengthen security across the campus through scripting, automation, data integration, and security tooling. The role centers on developing automated workflows, supporting incident response, and assisting with security assessments within a collaborative higher education environment.

Reporting to the Chief Information Security Officer, you will join the Information Security Office and help ensure regulatory compliance, best practices,

Qualifications

• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or Information Systems.
• Experience with Python or shell scripting for data manipulation.
• Experience in higher education or regulated data environment is preferred.

Responsibilities

• Data Ingestion Pipelines: develop, test, and maintain API integrations and webhooks for security data feeds.
• Playbook Maintenance: test, script, and maintain security playbooks and workflows in automation platforms.
• Workflow Integrations: build/manage automated workflows providing documentation and context during investigations.
• Operational Tooling Support: evaluate and adopt automation tools to improve alert triage and efficiency.
• Validate Results: review automated/AI analysis outputs for accuracy and reliability.

Skills

Python

Shell scripting

REST APIs

JSON/XML

Git

Education

Bachelor’s degree in CS/Engineering/Cybersecurity/Info Systems

Tools

Git

Security automation platforms

REST API testing tools

Job description

Position Title:Security Operations AnalystPosition Type:RegularHiring Range:$91,800 - $114,785 annually; Compensation will be based on education, experience, skills relevant to the role, and internal equity.Pay Frequency:AnnualPOSITION PURPOSEThe Security Operations Analyst is focused on supporting and enhancing security capabilities across the university through software scripting, automation maintenance, data integration, and the utilization of security tools. Working under the general guidance of senior team members, this position helps test, implement, and maintain automated security operations and workflows.Secondary duties include initial monitoring and triage of security events, supporting incident response, and assisting with security assessments. This role is designed for a technically curious individual looking to build foundational security engineering and operational experience within a collaborative higher education environment.The Security Operations Analyst reports to the Chief Information Security Officer and is a member of the Information Security Office. This office works with the university community to secure system and network resources, protect the confidentiality of student, faculty, and staff information, and raise cybersecurity awareness. In conjunction with technical teams, risk management, legal, and other university and external vendors and partners, the Information Security Office works to ensure regulatory compliance, best practices, and secure information handling.The activities of this position must support the Mission and Goals of the University and Information Services. Demonstrated experience with and a commitment to delivering excellent customer service is required.ESSENTIAL DUTIES AND RESPONSIBILITIES Security Automation & Operational ToolingData Ingestion Pipelines: Assist in the development, testing, and routine maintenance of API integrations and webhooks that connect internal asset inventories and security data feeds.Playbook Maintenance: Support the testing, scripting, and continuous maintenance of established security playbooks and workflows within security orchestration and automation platforms to streamline alert response times.Workflow Integrations: Help build and maintain automated workflows and integrations that provide security personnel with relevant documentation, procedures, and operational context during investigations.Operational Tooling Support: Test and evaluate emerging automation and AI-assisted productivity tools under guidance to help improve alert triage and operational efficiency.Validate Results: Review and validate automated or AI-assisted analysis results to ensure accuracy and reliable data outputs for the security team. Threat Detection & Operational ResponseAutomated Event Triage: Maintain and optimize basic Python and shell scripts used to automate the initial gathering of context and enrichment data for incoming security events.Threat Data Monitoring: Participate in cybersecurity intelligence-sharing communities to monitor external threat data and help cross-reference newly identified Indicators of Compromise (IOCs) against internal systems.Incident Support: Monitor security event queues, investigate anomalies, and serve as an operational contributor during security incidents under the direction of senior security personnel. Compliance, Documentation, & Security ReviewsParticipate in Security Reviews: Assist senior analysts in reviewing system configurations, data flows, and software deployments to verify alignment with university security standards and compliance guidelines.Document Processes: Help translate manual workflows into structured, reproducible scripts and maintain clear, up-to-date technical documentation.Promote Best Practices: Actively encourage information security best practices and contribute to campus cybersecurity awareness efforts.Other Duties: Perform other security-related duties and technical support tasks as assigned.PROVIDES WORK DIRECTIONThis position does not have any direct reports.GENERAL GUIDELINESWorks under general supervision to develop, test, and maintain programmatic security scripts and event triage workflows.Consults with senior analysts or supervisor on complex problems, policy interpretations, or high-risk architectural decisions.Identifies system alignment with security standards using automated validation workflows and tracks remediation efforts.Prepares and submits technical metrics and routine incident reports as requested.Interacts with the University community to identify potential security issues, and to foster relationships between the Security Office and the broader University community.QUALIFICATIONSTo perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The items below are representative of the knowledge, skills, abilities, education, and experience required or preferred. This position requires the ability to effectively establish and maintain cooperative working relationships within a diverse multicultural environment.1. Knowledge, Skills, and Abilities GeneralKnowledge of information technology, infrastructure trends, and information security concepts, with the ability to continually develop new technical knowledge and skills.Ability to work in a collaborative environment, as either a member or leader of a project team, to meet deadlines and achieve goals.Ability to interact with a diverse workforce to provide excellent customer service.Self-motivated, showing initiative and a passion for continuous improvement.Ability to successfully keep track of and manage multiple tasks and project assignments simultaneously.Ability to exercise independent judgment and engage in critical thinking and complex problem solving.Ability to manage multiple priorities and respond effectively to operational security issues in a dynamic technical environment.Ability to explain technical, risk, and automated security concepts to non-experts and diverse audiences.Ability to maintain confidentiality and securely manage confidential information.Must possess impeccable integrity, executing responsibilities while maintaining the trust and confidence of senior management.Appreciation for the University’s mission, vision, values, priorities, procedures, and policies. Position-SpecificProficiency in Python or shell scripting (e.g., Bash) for basic data manipulation, log parsing, or automating repetitive tasks.Basic understanding of RESTful APIs, webhooks, and standard data exchange formats like JSON or XML.Familiarity with core security concepts (e.g., common network protocols, operating system security internals, and log analysis).Familiarity with software engineering fundamentals (such as version control tools like Git).Basic understanding of common compliance and privacy standards relevant to a university setting (e.g., FERPA, GLBA).2. EducationBachelor’s degree from an accredited institution of higher education required in Computer Science, Engineering, Cybersecurity, or Information Systems.Security or automation-focused certifications preferred (e.g., Security+, GSEC, or certified Python/Cloud practitioner credentials).3. Experience5+ years of related technical experience in software development, IT operations, or information security operations or similar.Demonstrated experience building programmatic scripts, connecting via APIs, and automating technical workflows.Experience working within a Higher Education or highly regulated data environment is preferred.PHYSICAL DEMANDSThe physical demands described below are representative of those that must be met by an employee to successfully perform the essential functions of this job. In accordance with the Americans with Disabilities Act, as amended, the California Fair Employment & Housing Act, and all other applicable laws, reasonable accommodations are provided for qualified persons with disabilities.Considerable time is spent at a desk using a computer terminal.Will be required to travel to other buildings on the campus.May be required to occasionally travel to remote campuses, vendors, suppliers, or partners.May be required to attend conference and training sessions within the Bay Area or in- or out-of-state locations.WORK ENVIRONMENTThe work environment characteristics described below are representative of those an employee encounters while performing the essential functions of this job.Typical office and computer lab environment.Mostly indoor office environment with windows.Offices with equipment noise.Offices with frequent interruptions.TelecommuteSanta Clara University is registered to do business in the following states: California, Nevada, Oregon, Washington, Arizona, and Illinois. Employees approved to telecommute are required to perform their work within one of these states.EEO StatementEqual Opportunity/Notice of NondiscriminationSanta Clara University is an equal opportunity employer. All qualified applicants are encouraged to apply and will receive consideration for employment without regard to race, color, ethnicity, national origin, citizenship, ancestry, religion, age, sex, sexual orientation, gender, gender expression, gender identity, marital status, parental status, veteran or military status, physical or mental disability, medical conditions, pregnancy or related conditions, reproductive health decision making, or any other characteristic protected by federal, state, or local laws. For a complete copy of Santa Clara University’s equal opportunity and nondiscrimination policies, please visit the Office of Equal Opportunity and Title IX website at https://www.scu.edu/title-ix/ .Clery Notice of AvailabilitySanta Clara University annually collects information about campus crimes and other reportable incidents in accordance with the federal Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act. To view the Santa Clara University report, please visit the Campus Safety Services website . To request a paper copy please call Campus Safety at [phone]. The report includes the type of crime, venue, and number of occurrences.Americans with Disabilities ActConsistent with its obligations under the law, Santa Clara University will provide reasonable accommodations to applicants and employees with disabilities. Applicants who wish to request a reasonable accommodation for any part of the application or hiring process should contact the Department of Human Resources ADA Team at [e-mail] or by phone at [phone]. Please note : This contact information is intended for accommodation requests only. Resumes or inquiries about application status sent to this inbox will not be reviewed or forwarded. For resumes or questions regarding application status, please contact [e-mail] .