Senior Cybersecurity Operations Engineer

University of Colorado Boulder; Boulder (CO); Hybrid; USD 100,000 - 110,000; Full time

Benefits offered by this job

Medical, dental, and retirement plans

Tuition assistance for you and your/de

Transit ECO Pass

Job summary

University of Colorado Boulder is seeking a Senior Cybersecurity Operations Engineer to lead incident response, detection engineering, and security monitoring efforts. The role oversees log-ingestion pipelines, detections, dashboards, and automation to improve response workflows.

The Senior Engineer collaborates with IT providers, system owners, and university partners, translating technical findings into risk insights and actionable improvements. Hybrid work is available.

Qualifications

• Bachelor's degree in cybersecurity, computer science, information technology, engineering, or a related field.
• Demonstrated 3+ years of cybersecurity operations, incident response, or security monitoring.
• Experience investigating cybersecurity events using telemetry from endpoints, networks, email, cloud, or applications.

Responsibilities

• Lead or support cybersecurity incidents through detection, containment, and post-incident review.
• Design, develop, test, deploy, document, and tune detections across multiple data sources.
• Develop dashboards, searches, alerts, reports, and coverage metrics for monitoring and leadership awareness.
• Maintain incident‑response playbooks, runbooks, and escalation procedures; translate findings into risk and remediation recommendations.
• Mentor colleagues and student employees as needed.

Skills

Cybersecurity operations

Incident response

Security monitoring

Detection engineering

Scripting (Python/PowerShell)

Communication

Mentoring

Collaboration

Education

Bachelor's degree in cybersecurity/CS/IT/engineering

Tools

SIEM

EDR/XDR

Log ingestion pipelines

Job description

Job Summary

The Office of Information Technology encourages applications for a Senior Cybersecurity Operations Engineer! The Engineer is a senior technical role responsible for cybersecurity incident response, detection engineering, security monitoring, and the engineering and operational reliability of supporting security technologies. The position within the Security Operations team leads or coordinates technical response activities for assigned incidents, helping ensure incidents are appropriately analyzed, contained, resolved, documented, and escalated in accordance with university processes.

This role serves as the team’s lead for Security Information and Event Management capabilities and ensures that monitoring capabilities remain reliable, appropriately tuned, capable of producing actionable detections, and aligned with evolving threats and university operational requirements. Responsibilities include engineering and maintaining log-ingestion pipelines, developing and validating detections, creating operational dashboards, tuning alerts, monitoring data quality and platform health, and improving response workflows through automation.

The position works closely with members of the security team, central and distributed IT providers, system and service owners, and other university partners. The role translates technical findings into clear risk, remediation, and control-improvement recommendations while supporting the university’s teaching, research, administrative, and public-service missions. The position may provide technical direction and mentoring to colleagues. The position reports to the Security Operations Senior Program Manager.

CU is an Equal Opportunity Employer and complies with all applicable federal, state, and local laws governing nondiscrimination in employment. We are committed to creating a workplace where all individuals are treated with respect and dignity, and we encourage individuals from all backgrounds to apply, including protected veterans and individuals with disabilities.

Who We Are

Vision: The Office of Information Technology is a strategic, inclusive and innovative partner in advancing learning and discovery in order to enable CU Boulder to be a premier public university.

Mission: The Office of Information Technology enables campus priorities by providing high-value IT services and solutions.

Values: Trust, as a foundation for how we engage with one another and with campus partners, along with Avid curiosity in how to better support the campus and our partners while Fostering empowerment and authentic engagement among ourselves and Celebrating inclusivity that promotes a sense of belonging while acknowledging that each person is unique and valued.

Strategy: OIT will advance learning and discovery by delivering high-value reliable IT services and solutions that:

• Provide a fluid and adaptable academic and student experience
• Enable research competitiveness and
• Deliver core infrastructure and enterprise IT services for business effectiveness

What Your Key Responsibilities Will Be

Duties and responsibilities of the position include, but are not limited to:

Incident Response and Technical Investigation

• Lead or support cybersecurity incidents through identification, scoping, analysis, containment, eradication, recovery, and post-incident review.
• Coordinate technical response activities with information security personnel, IT service providers, system owners, and other authorized partners.
• Analyze endpoint, network, email, identity, cloud, application, and other relevant telemetry to establish incident scope, attack path, affected assets, and required corrective action.
• Develop incident timelines, document technical findings, and prepare reports that describe root cause, business implications, response actions, and recommended improvements.
• Manage or support the technical operation of the university’s email-threat detection and response capabilities, including analysis of false positives, missed detections, and user-submitted reports.
• Identify recurring control failures and recommend sustainable technical improvements.

Detection Engineering, SIEM, and Security Monitoring

• Serve as a technical owner for SIEM and related monitoring capabilities, including log onboarding, data routing, parsing, enrichment, normalization, retention, access control, platform health, and integration reliability.
• Design, develop, test, deploy, document, and tune detections across endpoint, network, email, identity, cloud, application, and other relevant data sources.
• Develop dashboards, searches, alerts, reports, and coverage metrics that support operational monitoring, investigation, and leadership awareness.
• Develop and maintain automated enrichment, triage, notification, containment, and response workflows.
• Use threat information, incident findings, and changes in university technology to identify and close monitoring gaps.
• Partner with service owners to establish appropriate logging, monitoring, alerting, and incident‑response requirements.

Documentation, Consulting, and Technical Leadership

• Maintain and develop incident‑response playbooks, runbooks, escalation procedures, investigative methods, and technical response documentation.
• Translate technical findings into clear risk and remediation recommendations for technical and nontechnical audiences.
• Provide subject‑matter consultation to technology providers and system owners concerning monitoring, response, logging, and control improvement.
• Mentor colleagues and student employees, when assigned.

What You Should Know

• This position is in a hybrid work situation. It offers remote‑work flexibility, but requires periodic campus presence for evidence collection, investigations, operational needs, and other activities requiring physical access.
• The work schedule will require after hours as required during incident response.
• Visa sponsorship is not available for this position.
• Due to the requirement to access export‑controlled data and information, only U.S. citizens, lawful permanent residents (green cards), or other protected individuals (i.e., persons designated as an asylee, refugee, or a temporary resident under amnesty provisions) may apply.

What We Can Offer

The annual salary range for this position is $99,700 - $109,660.

Benefits

At the University of Colorado Boulder, we are committed to supporting the holistic health and well‑being of our employees. Our comprehensive benefits package includes medical, dental, and retirement plans; generous paid time off; tuition assistance for you and your dependents; and an ECO Pass for local transit. As one of Boulder County’s largest employers, CU Boulder offers an inspiring academic community and access to world‑class outdoor recreation. In fact, CU Boulder has been named one of Forbes' America's Best Large Employers, ranking #4 among large employers in Colorado and #28 among universities nationwide. Explore additional perks and programs through the CU Advantage program.

Be authentic. Be pioneering. Be Boulder.

What We Require

• Bachelor’s degree in cybersecurity, computer science, information technology, engineering, or a related field, or an equivalent combination of education, technical training, certifications, and relevant professional experience.
• At least 3 years of progressively responsible experience in cybersecurity operations, incident response, detection engineering, security monitoring, systems or network administration, digital forensics, or a closely related technical area.
• Demonstrated experience investigating cybersecurity events using endpoint, network, email, identity, application, cloud, or SIEM telemetry.
• Demonstrated experience operating or improving a SIEM, EDR/XDR, network‑monitoring, email security, or comparable security capability.
• Due to the requirement to access export‑controlled data and information, only U.S. citizens, lawful permanent residents (green cards), or other protected individuals (i.e., persons designated as an asylee, refugee, or a temporary resident under amnesty provisions) may apply

What You Will Need

Knowledge

• Knowledge of cybersecurity and privacy principles.
• Knowledge of incident‑response, incident‑handling, and post‑incident review methodologies.
• Knowledge of networking fundamentals, including TCP/IP, DNS, routing, network segmentation, firewalls, and common network telemetry.
• Knowledge of Windows, Linux, and macOS security and logging concepts.
• Knowledge of authentication, identity, access, endpoint, email, cloud, and application telemetry relevant to security investigations.
• Knowledge of SIEM, EDR/XDR, network security monitoring, and security automation concepts.
• Knowledge of detection‑development, testing, tuning, documentation, and lifecycle‑management practices.

Skills

• Skill in correlating data across endpoint, network, identity, email, cloud, and application sources.
• Skill in designing, documenting, testing, and tuning detections and response workflows.
• Skill in preparing technical reports, executive summaries, briefings, procedures, runbooks, and playbooks.
• Skill in scripting, querying, workflow automation, or API integration using languages and tools such as Python, PowerShell, Bash, regular expressions, structured query languages, or comparable technologies.

Abilities

• Ability to communicate complex information in a clear, accurate, and well‑organized manner through verbal, written, and visual means.
• Ability to collaborate effectively with security personnel, central and distributed IT providers, system owners, university leadership, and authorized external parties.
• Ability to translate technical findings into appropriate corrective actions and sustainable control improvements.
• Ability to balance investigative thoroughness, operational urgency, service continuity, privacy, and institutional risk.
• Ability to work independently, manage competing priorities, and exercise good judgment when handling sensitive information.
• Ability to mentor colleagues and student employees when assigned.
• Ability to learn unfamiliar technologies and adapt monitoring and response practices as the university’s environment changes.

What We Would Like You to Have

• 6 or more years of progressively responsible experience in cybersecurity operations, incident response, detection engineering, digital forensics, or security‑platform engineering.
• Experience administering, engineering, or serving as a technical owner for a SIEM or large‑scale security‑monitoring service.
• Experience developing detections, correlation logic, dashboards, parsing rules, enrichment, or automated‑response workflows.
• Experience with endpoint, network, email, identity, cloud, and application‑security telemetry.
• Experience scripting or automating security workflows using Python, PowerShell, Bash, APIs, or comparable technologies.
• Experience monitoring or investigating network traffic and security‑device telemetry.
• Experience developing and documenting processes, playbooks, runbooks, technical standards, or architecture diagrams.
• Experience collaborating across decentralized technology environments or multiple organizational units.
• Experience in higher education, research institutions, healthcare, government, or another large decentralized environment.
• Experience documenting technical findings, procedures, or recommendations for technical and nontechnical audiences.
• Relevant training or certification in incident response, digital forensics, network security monitoring, SIEM engineering, cloud security, or related disciplines. Examples may include GIAC, CISSP, Security+, CySA+, SC-200, vendor‑specific technical credentials, or equivalent applied training.