Senior Cybersecurity Operations Engineer

University of Colorado System; Allenspark (CO); Hybrid; USD 100,000 - 110,000; Full time

Job summary

University of Colorado Boulder is seeking a Senior Cybersecurity Operations Engineer to lead incident response and detection engineering within the Security Operations team. The role focuses on monitoring, alerting, and improving threat detection across endpoint, network, and cloud environments.

The engineer will own SIEM and related monitoring capabilities, develop detections, and automate response workflows while collaborating with campus IT, system owners, and partners.

Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, engineering, or a related field.
• At least 3 years of progressively responsible experience in cybersecurity operations, incident response, detection engineering, security monitoring, or related areas.
• Experience investigating cybersecurity events using telemetry from endpoint, network, email, identity, cloud, or SIEM.

Responsibilities

• Lead or coordinate cybersecurity incident responses from identification through containment and recovery.
• Own SIEM and monitoring capabilities, including log onboarding, data routing, parsing, enrichment, and health.
• Develop and tune detections across endpoint, network, email, identity, cloud, and applications.
• Create dashboards, alerts, and reports to support monitoring and leadership awareness.
• Mentor colleagues and student employees as assigned.

Skills

Incident response

Detection engineering

SIEM

Security monitoring

Automation

Education

Bachelor’s degree in cybersecurity or related field

Tools

SIEM

EDR/XDR

Job description

Job Summary

The Office of Information Technology encourages applicationsfor a Senior Cybersecurity Operations Engineer! TheEngineer is a senior technical role responsible for cybersecurityincident response, detection engineering, security monitoring, andthe engineering and operational reliability of supporting securitytechnologies. The position within the Security Operations teamleads or coordinates technical response activities for assignedincidents, helping ensure incidents are appropriately analyzed,contained, resolved, documented, and escalated in accordance withuniversity processes.

This role serves as the team’s lead for Security Information andEvent Management capabilities and ensures that monitoringcapabilities remain reliable, appropriately tuned, capable ofproducing actionable detections, and aligned with evolving threatsand university operational requirements. Responsibilities includeengineering and maintaining log-ingestion pipelines, developing andvalidating detections, creating operational dashboards, tuningalerts, monitoring data quality and platform health, and improvingresponse workflows through automation.

The position works closely with members of the security team,central and distributed IT providers, system and service owners,and other university partners. The role translates technicalfindings into clear risk, remediation, and control-improvementrecommendations while supporting the university’s teaching,research, administrative, and public-service missions. The positionmay provide technical direction and mentoring to colleagues. Theposition reports to the Security Operations Senior ProgramManager.

CU is an Equal Opportunity Employer and complies with allapplicable federal, state, and local laws governingnondiscrimination in employment. We are committed to creating aworkplace where all individuals are treated with respect anddignity, and we encourage individuals from all backgrounds toapply, including protected veterans and individuals withdisabilities.

Who We Are

Vision:

• The Office of Information Technology is a strategic, inclusiveand innovative partner in advancing learning and discovery in orderto enable CU Boulder to be a premier public university.

Mission:

• The Office of Information Technology enables campus prioritiesby providing high-value IT services and solutions.

Values:

• Trust, as a foundation for how we engage with one another andwith campus partners, along with
• Avid curiosity in how to better support the campus and ourpartners while
• Fostering empowerment and authentic engagement among ourselvesand
• Celebrating inclusivity that promotes a sense of belongingwhile acknowledging that each person is unique and valued.

Strategy:

• OIT will advance learning and discovery by deliveringhigh-value reliable IT services and solutions that:
• Provide a fluid and adaptable academic and studentexperience
• Enable research competitiveness and
• Deliver core infrastructure and enterprise IT services forbusiness effectiveness

What Your Key Responsibilities Will Be

Duties and responsibilities of the position include, but are notlimited to:

Incident Response and Technical Investigation

• Lead or support cybersecurity incidents through identification,scoping, analysis, containment, eradication, recovery, andpost-incident review.
• Coordinate technical response activities with informationsecurity personnel, IT service providers, system owners, and otherauthorized partners.
• Analyze endpoint, network, email, identity, cloud, application,and other relevant telemetry to establish incident scope, attackpath, affected assets, and required corrective action.
• Develop incident timelines, document technical findings, andprepare reports that describe root cause, business implications,response actions, and recommended improvements.
• Manage or support the technical operation of the university’semail-threat detection and response capabilities, includinganalysis of false positives, missed detections, and user-submittedreports.
• Identify recurring control failures and recommend sustainabletechnical improvements.

Detection Engineering, SIEM, and Security Monitoring

• Serve as a technical owner for SIEM and related monitoringcapabilities, including log onboarding, data routing, parsing,enrichment, normalization, retention, access control, platformhealth, and integration reliability.
• Design, develop, test, deploy, document, and tune detectionsacross endpoint, network, email, identity, cloud, application, andother relevant data sources.
• Develop dashboards, searches, alerts, reports, and coveragemetrics that support operational monitoring, investigation, andleadership awareness.
• Develop and maintain automated enrichment, triage,notification, containment, and response workflows.
• Use threat information, incident findings, and changes inuniversity technology to identify and close monitoring gaps.
• Partner with service owners to establish appropriate logging,monitoring, alerting, and incident-response requirements.

Documentation, Consulting, and Technical Leadership

• Maintain and develop incident-response playbooks, runbooks,escalation procedures, investigative methods, and technicalresponse documentation.
• Translate technical findings into clear risk and remediationrecommendations for technical and nontechnical audiences.
• Provide subject-matter consultation to technology providers andsystem owners concerning monitoring, response, logging, and controlimprovement.
• Mentor colleagues and student employees, when assigned.

What You Should Know

• This position is in a hybrid work situation. It offersremote-work flexibility, but requires periodic campus presence forevidence collection, investigations, operational needs, and otheractivities requiring physical access.
• The work schedule will require after hours as required duringincident response.
• Visa sponsorship is not available for this position.
• Due to the requirement to access export-controlled data andinformation, only U.S. citizens, lawful permanent residents (greencards), or other protected individuals (i.e., persons designated asan asylee, refugee, or a temporary resident under amnestyprovisions) may apply.

What We Can Offer

• The annual salary range for this position is $99,700 -$109,660.

Benefits

At the University of Colorado Boulder, we are committed to supporting the holistic health and well-being of ouremployees. Our comprehensive benefits package includes medical,dental, and retirement plans; generous paid time off; tuitionassistance for you and your dependents; and an ECO Pass for localtransit. As one of Boulder County’s largest employers, CU Boulderoffers an inspiring academic community and access to world-classoutdoor recreation. In fact, CU Boulder has been named one of Forbes' America's BestLarge Employers , ranking #4 among large employers in Coloradoand #28 among universities nationwide. Explore additional perks andprograms through the CU Advantage program.

Be Statements

Be authentic. Be pioneering. Be Boulder.

What We Require

• Bachelor’s degree in cybersecurity, computer science,information technology, engineering, or a related field, or anequivalent combination of education, technical training,certifications, and relevant professional experience.
• At least 3 years of progressively responsible experience incybersecurity operations, incident response, detection engineering,security monitoring, systems or network administration, digitalforensics, or a closely related technical area.
• Demonstrated experience investigating cybersecurity eventsusing endpoint, network, email, identity, application, cloud, orSIEM telemetry.
• Demonstrated experience operating or improving a SIEM, EDR/XDR,network-monitoring, email security, or comparable securitycapability.

Due to the requirement to access export-controlled data andinformation, only U.S. citizens, lawful permanent residents (greencards), or other protected individuals (i.e., persons designated asan asylee, refugee, or a temporary resident under amnestyprovisions) may apply

What You Will Need

Knowledge

• Knowledge of cybersecurity and privacy principles.
• Knowledge of incident-response, incident-handling, andpost-incident review methodologies.
• Knowledge of networking fundamentals, including TCP/IP, DNS,routing, network segmentation, firewalls, and common networktelemetry.
• Knowledge of Windows, Linux, and macOS security and loggingconcepts.
• Knowledge of authentication, identity, access, endpoint, email,cloud, and application telemetry relevant to securityinvestigations.
• Knowledge of SIEM, EDR/XDR, network security monitoring, andsecurity automation concepts.
• Knowledge of detection-development, testing, tuning,documentation, and lifecycle-management practices.

Skills

• Skill in correlating data across endpoint, network, identity,email, cloud, and application sources.
• Skill in designing, documenting, testing, and tuning detectionsand response workflows.
• Skill in preparing technical reports, executive summaries,briefings, procedures, runbooks, and playbooks.
• Skill in scripting, querying, workflow automation, or APIintegration using languages and tools such as Python, PowerShell,Bash, regular expressions, structured query languages, orcomparable technologies.

Abilities

• Ability to communicate complex information in a clear,accurate, and well-organized manner through verbal, written, andvisual means.
• Ability to collaborate effectively with security personnel,central and distributed IT providers, system owners, universityleadership, and authorized external parties.
• Ability to translate technical findings into appropriatecorrective actions and sustainable control improvements.
• Ability to balance investigative thoroughness, operationalurgency, service continuity, privacy, and institutional risk.
• Ability to work independently, manage competing priorities, andexercise good judgment when handling sensitive information.
• Ability to mentor colleagues and student employees whenassigned.
• Ability to learn unfamiliar technologies and adapt monitoringand response practices as the university’s environmentchanges.

What We Would Like You to Have

• 6 or more years of progressively responsible experience incybersecurity operations, incident response, detection engineering,digital forensics, or security-platform engineering.
• Experience administering, engineering, or serving as atechnical owner for a SIEM or large-scale security-monitoringservice.
• Experience developing detections, correlation logic,dashboards, parsing rules, enrichment, or automated-responseworkflows.
• Experience with endpoint, network, email, identity, cloud, andapplication-security telemetry.
• Experience scripting or automating security workflows usingPython, PowerShell, Bash, APIs, or comparable technologies.
• Experience monitoring or investigating network traffic andsecurity-device telemetry.
• Experience developing and documenting processes, playbooks,runbooks, technical standards, or architecture diagrams.
• Experience collaborating across decentralized technologyenvironments or multiple organizational units.
• Experience in higher education, research institutions,healthcare, government, or another large decentralizedenvironment.
• Experience documenting technical findings, procedures, orrecommendations for technical and nontechnical audiences.
• Relevant training or certification in incident response,digital forensics, network security monitoring, SIEM engineering,cloud security, or related disciplines. Examples may include GIAC,CISSP, Security+, CySA+, SC-200, vendor-specific technicalcredentials, or equivalent applied training.