Security Operations Engineer — Cloud Incident Response

Cisco; Portland (OR); Hybrid; USD 129,000 - 185,000; Full time

Benefits offered by this job

Health insurance

401(k) with Cisco matching

Paid parental leave

Short/long-term disability

Basic life insurance

Cisco RSU grants

Job summary

Cisco is seeking a highly skilled SecOps professional to join the Security Business Group's Operations Team in Portland, OR. You will manage vulnerabilities across container, host, and cloud ecosystems, serve as Incident Commander during critical events, and lead threat hunting and automation efforts using AI/LLM tooling and REST APIs.

You will work with Splunk and other enterprise tools, collaborate with cross-functional teams, and drive improvements in detection, response, and security posture

Qualifications

• 4+ years in a dedicated SOC, Cloud Security, or IR role in a modern enterprise.
• Experience with AWS, Azure and GCP.
• Experience with vulnerability lifecycle management and remediation across microservices.
• Incident response experience following NIST SP 800-61 / ISO standards.
• Experience analyzing logs/telemetry in enterprise SIEMs (Splunk) and Linux.
• Experience authoring postmortems/SOPs and strong written/verbal communication.
• Experience using AI/LLMs to enrich alerts or automate workflows.

Responsibilities

• Lead vulnerability triage across container, host, and cloud infra.
• Drive remediation SLAs across product engineering queues.
• Act as Incident Commander for critical security incidents.
• Coordinate cross-functional triage calls and postmortems.
• Develop automated detection rules from threat hunts.
• Collaborate with governance for compliance evidence.
• Develop automated workflows and runbooks (Python).
• Leverage REST APIs to automate security workflows.

Skills

SOC operations

Cloud security

Incident response

SIEM (Splunk)

Python automation

AI/LLM tooling

Threat hunting

Communication

Education

Bachelor’s degree in Cybersecurity or related

Tools

Splunk

Kubernetes

Wiz

Falco

Jira

GitHub

REST APIs

Job description

Cisco is seeking a highly skilled SecOps professional to join the Security Business Group's Operations Team in Portland, OR. You will manage vulnerabilities across container, host, and cloud ecosystems, serve as Incident Commander during critical events, and lead threat hunting and automation efforts using AI/LLM tooling and REST APIs.

You will work with Splunk and other enterprise tools, collaborate with cross-functional teams, and drive improvements in detection, response, and security posture