Security Operations Analyst

Santa Clara University; Santa Clara (CA); On-site; USD 92,000 - 115,000; Full time

Job summary

Santa Clara University is seeking a Security Operations Analyst to support and enhance security capabilities through scripting, automation maintenance, data integration, and security tools. The role involves testing and maintaining automated security workflows, initial event triage, incident support, and contributing to security assessments within a collaborative university setting.

The position reports to the Chief Information Security Officer and is part of the Information Security Office,

Qualifications

• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or Information Systems is required.
• 5+ years of related technical experience in software development, IT operations, or information security operations or similar is preferred.
• Security or automation-focused certifications are preferred (e.g., Security+, GSEC).

Responsibilities

• Develop, test, and maintain API integrations and webhooks for data ingestion and security data feeds.
• Test, script, and maintain security playbooks and workflows in SOAR platforms.
• Build and maintain automated workflows and integrations for investigations.
• Evaluate emerging automation and AI-assisted tools to improve alert triage and efficiency.
• Review automated results for accuracy and reliability for the security team.
• Monitor security event queues, investigate anomalies, and assist with incidents.

Skills

Python scripting

Shell scripting

RESTful APIs

Security concepts

Analytical thinking

Team collaboration

Automation tooling

Data integration

Education

Bachelor's degree in CS/Engineering/Cybersecurity/Information Systems

Tools

Git

Job description

Position Title: Security Operations Analyst

Position Type: Regular

Hiring Range: $91,800 - $114,785 annually; Compensation will be based on education, experience, skills relevant to the role, and internal equity.

Pay Frequency: Annual

POSITION PURPOSE

The Security Operations Analyst is focused on supporting and enhancing security capabilities across the university through software scripting, automation maintenance, data integration, and the utilization of security tools. Working under the general guidance of senior team members, this position helps test, implement, and maintain automated security operations and workflows. Secondary duties include initial monitoring and triage of security events, supporting incident response, and assisting with security assessments. This role is designed for a technically curious individual looking to build foundational security engineering and operational experience within a collaborative higher education environment. The Security Operations Analyst reports to the Chief Information Security Officer and is a member of the Information Security Office. This office works with the university community to secure system and network resources, protect the confidentiality of student, faculty, and staff information, and raise cybersecurity awareness. In conjunction with technical teams, risk management, legal, and other university and external vendors and partners, the Information Security Office works to ensure regulatory compliance, best practices, and secure information handling.

The activities of this position must support the Mission and Goals of the University and Information Services. Demonstrated experience with and a commitment to delivering excellent customer service is required.

Essential Duties And Responsibilities

Security Automation & Operational Tooling

• Data Ingestion Pipelines: Assist in the development, testing, and routine maintenance of API integrations and webhooks that connect internal asset inventories and security data feeds.
• Playbook Maintenance: Support the testing, scripting, and continuous maintenance of established security playbooks and workflows within security orchestration and automation platforms to streamline alert response times.
• Workflow Integrations: Help build and maintain automated workflows and integrations that provide security personnel with relevant documentation, procedures, and operational context during investigations.
• Operational Tooling Support: Test and evaluate emerging automation and AI‑assisted productivity tools under guidance to help improve alert triage and operational efficiency.
• Validate Results: Review and validate automated or AI‑assisted analysis results to ensure accuracy and reliable data outputs for the security team.

Threat Detection & Operational Response

• Automated Event Triage: Maintain and optimize basic Python and shell scripts used to automate the initial gathering of context and enrichment data for incoming security events.
• Threat Data Monitoring: Participate in cybersecurity intelligence‑sharing communities to monitor external threat data and help cross‑reference newly identified Indicators of Compromise (IOCs) against internal systems.
• Incident Support: Monitor security event queues, investigate anomalies, and serve as an operational contributor during security incidents under the direction of senior security personnel.

Compliance, Documentation, & Security Reviews

• Participate in Security Reviews: Assist senior analysts in reviewing system configurations, data flows, and software deployments to verify alignment with university security standards and compliance guidelines.
• Document Processes: Help translate manual workflows into structured, reproducible scripts and maintain clear, up‑to‑date technical documentation.
• Promote Best Practices: Actively encourage information security best practices and contribute to campus cybersecurity awareness efforts.
• Other Duties: Perform other security‑related duties and technical support tasks as assigned.

PROVIDES WORK DIRECTION

This position does not have any direct reports.

GENERAL GUIDELINES

• Works under general supervision to develop, test, and maintain programmatic security scripts and event triage workflows.
• Consults with senior analysts or supervisor on complex problems, policy interpretations, or high‑risk architectural decisions.
• Identifies system alignment with security standards using automated validation workflows and tracks remediation efforts.
• Prepares and submits technical metrics and routine incident reports as requested.
• Interacts with the University community to identify potential security issues, and to foster relationships between the Security Office and the broader University community.

Qualifications

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The items below are representative of the knowledge, skills, abilities, education, and experience required or preferred. This position requires the ability to effectively establish and maintain cooperative working relationships within a diverse multicultural environment.

Knowledge, Skills, and Abilities - General

• Knowledge of information technology, infrastructure trends, and information security concepts, with the ability to continually develop new technical knowledge and skills.
• Ability to work in a collaborative environment, as either a member or leader of a project team, to meet deadlines and achieve goals.
• Ability to interact with a diverse workforce to provide excellent customer service.
• Self‑motivated, showing initiative and a passion for continuous improvement.
• Ability to successfully keep track of and manage multiple tasks and project assignments simultaneously.
• Ability to exercise independent judgment and engage in critical thinking and complex problem solving.
• Ability to manage multiple priorities and respond effectively to operational security issues in a dynamic technical environment.
• Ability to explain technical, risk, and automated security concepts to non‑experts and diverse audiences.
• Ability to maintain confidentiality and securely manage confidential information.
• Must possess impeccable integrity, executing responsibilities while maintaining the trust and confidence of senior management.
• Appreciation for the University’s mission, vision, values, priorities, procedures, and policies.

Position‑Specific

• Proficiency in Python or shell scripting (e.g., Bash) for basic data manipulation, log parsing, or automating repetitive tasks.
• Basic understanding of RESTful APIs, webhooks, and standard data exchange formats like JSON or XML.
• Familiarity with core security concepts (e.g., common network protocols, operating system security internals, and log analysis).
• Familiarity with software engineering fundamentals (such as version control tools like Git).
• Basic understanding of common compliance and privacy standards relevant to a university setting (e.g., FERPA, GLBA).
• Education
• Bachelor’s degree from an accredited institution of higher education required in Computer Science, Engineering, Cybersecurity, or Information Systems.
• Security or automation‑focused certifications preferred (e.g., Security+, GSEC, or certified Python/Cloud practitioner credentials).
• Experience
• 5+ years of related technical experience in software development, IT operations, or information security operations or similar.
• Demonstrated experience building programmatic scripts, connecting via APIs, and automating technical workflows.
• Experience working within a Higher Education or highly regulated data environment is preferred.

PHYSICAL DEMANDS

• Considerable time is spent at a desk using a computer terminal.
• Will be required to travel to other buildings on the campus.
• May be required to occasionally travel to remote campuses, vendors, suppliers, or partners.
• May be required to attend conference and training sessions within the Bay Area or in‑or out‑of‑state locations.

WORK ENVIRONMENT

• Typical office and computer lab environment.
• Mostly indoor office environment with windows.
• Offices with equipment noise.
• Offices with frequent interruptions.

Santa Clara University is registered to do business in the following states: California, Nevada, Oregon, Washington, Arizona, and Illinois. Employees approved to telecommute are required to perform their work within one of these states.

EEO Statement

Equal Opportunity/Notice of Nondiscrimination

Santa Clara University is an equal opportunity employer. All qualified applicants are encouraged to apply and will receive consideration for employment without regard to race, color, ethnicity, national origin, citizenship, ancestry, religion, age, sex, sexual orientation, gender, gender expression, gender identity, marital status, parental status, veteran or military status, physical or mental disability, medical conditions, pregnancy or related conditions, reproductive health decision making, or any other characteristic protected by federal, state, or local laws. For a complete copy of Santa Clara University’s equal opportunity and nondiscrimination policies, please visit the Office of Equal Opportunity and Title IX website at https://www.scu.edu/title-ix/.

Clery Notice of Availability

Santa Clara University annually collects information about campus crimes and other reportable incidents in accordance with the federal Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act. To view the Santa Clara University report, please visit the Campus Safety Services website. To request a paper copy please call Campus Safety at [phone]. The report includes the type of crime, venue, and number of occurrences.

Americans with Disabilities Act

Consistent with its obligations under the law, Santa Clara University will provide reasonable accommodations to applicants and employees with disabilities. Applicants who wish to request a reasonable accommodation for any part of the application or hiring process should contact the Department of Human Resources ADA Team at [e-mail] or by phone at [phone]. Please note: This contact information is intended for accommodation requests only. Resumes or inquiries about application status sent to this inbox will not be reviewed or forwarded. For resumes or questions regarding application status, please contact [e-mail].