Security Operations Engineer – IR & Threat Hunting

Cisco; Boulder (CO); On-site; USD 140,000 - 210,000; Full time

Job summary

Cisco's Security Business Group (SBG) SecOps team is seeking a hands-on security operations professional to defend our enterprise and cloud environments. You will work with world-class engineers, researchers and developers in an inclusive, high-impact setting that encourages learning and mentorship.

This role spans vulnerability management, incident response, threat hunting, and governance, with automation in Python and use of AI/LLMs to accelerate triage.

Qualifications

• 4+ years of hands-on experience in a dedicated SOC, Cloud Security, or Incident Response role.
• Experience with cloud architecture (AWS, Azure and GCP).
• Experience with vulnerability lifecycle management and remediation across complex microservice environments.
• Incident response experience following NIST SP 800-61 / ISO standards.
• Experience with log and telemetry analysis in enterprise SIEMs (Splunk) and Linux logs.
• Experience authoring postmortems and SOPs and strong written and verbal communication skills.
• Experience leveraging AI/LLMs for alert enrichment and automation.

Responsibilities

• Manage, triage, and validate container, host, and cloud findings across enterprise scanners.
• Drive vulnerability prioritization, validate false positives, and enforce remediation SLAs.
• Serve as an Incident Commander during critical-severity security incidents.
• Lead cross-functional triage calls, direct containment and eradication strategies, coordinate forensics, and facilitate postmortem retrospectives.
• Analyze telemetry to detect adversary tactics mapped to MITRE ATT&CK framework.
• Formulate and execute threat hunts, converting findings into automated detections and alerts.
• Partner with governance teams to collect, validate, and orchestrate technical control evidence for audits.
• Engineer automated workflows, runbooks, and scripts (Python) to reduce operational bottlenecks.
• Leverage AI/LLM tooling to accelerate triage workflows and threat analysis.

Skills

SOC experience

Cloud architecture

Vulnerability management

Incident response

SIEM (Splunk)

Postmortems

AI/LLMs usage

Education

Bachelor's degree

Tools

Kubernetes

Wiz

Falco

Jira

GitHub

Cloud APIs

Job description

Cisco's Security Business Group (SBG) SecOps team is seeking a hands-on security operations professional to defend our enterprise and cloud environments. You will work with world-class engineers, researchers and developers in an inclusive, high-impact setting that encourages learning and mentorship.

This role spans vulnerability management, incident response, threat hunting, and governance, with automation in Python and use of AI/LLMs to accelerate triage.