Security Ops Engineer: Incident Commander & Threat Hunter

Cisco Systems; Boulder (CO); Hybrid; USD 140,000 - 200,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) with company match

Paid parental leave

Paid time off

On-call rotations and global team

Job summary

Cisco Systems is seeking a seasoned SecOps professional to lead vulnerability management, incident response, and detection engineering for our Security Business Group. The role spans governance, automation, and threat hunting across cloud and on-prem environments.

You will collaborate with security engineers, researchers, and developers to implement automated workflows, runbooks, and MITRE-aligned detections while advancing security operations maturity in a global enterprise.

Qualifications

• 4+ years in SOC, Cloud Security, or Incident Response in a modern enterprise
• Experience with AWS, Azure, and GCP
• Experience with vulnerability lifecycle management and remediation in microservices
• IR experience following NIST SP 800-61 / ISO standards
• Experience with security logs in SIEMs and Linux logs
• Experience authoring postmortems and SOPs
• Experience leveraging AI/LLMs for alert enrichment or automation

Responsibilities

• Manage and triage container, host, and cloud findings across enterprise scanners
• Drive remediation SLAs and validate false positives in product engineering queues
• Serve as Incident Commander during critical security incidents
• Lead cross-functional triage calls and coordinate containment/eradication
• Analyze telemetry to detect adversary tactics mapped to MITRE ATT&CK
• Formulate threat hunts and convert findings into automated detections
• Partner with governance teams to collect evidence for audits
• Engineer automated workflows and scripts to reduce operational bottlenecks
• Leverage AI/LLM tooling and REST APIs to accelerate triage workflows

Skills

SOC operations

Cloud security

Incident response

Vulnerability management

Log/telemetry analysis

Postmortems & SOPs

AI/LLM automation

Education

Bachelor’s degree in cybersecurity or equivalent

Tools

Splunk

REST APIs

Jira

Kubernetes

Job description

Cisco Systems is seeking a seasoned SecOps professional to lead vulnerability management, incident response, and detection engineering for our Security Business Group. The role spans governance, automation, and threat hunting across cloud and on-prem environments.

You will collaborate with security engineers, researchers, and developers to implement automated workflows, runbooks, and MITRE-aligned detections while advancing security operations maturity in a global enterprise.