Senior Incident Commander - Security Operations

StratITech; Phoenix (AZ); On-site; USD 150,000 - 195,000; Full time

Job summary

StratITech is seeking a Principal Security Operations Engineer to lead cybersecurity incident response, security operations, and advanced investigations across a distributed enterprise. This leader will own high-severity incidents, work across firewalls, DNS, AD, cloud logs, and SIEM pipelines, and guide teams while remaining hands-on.

The role emphasizes technical credibility, mentorship, and continuous improvement of incident response practices, with collaboration across infrastructure,

Qualifications

• Senior-level experience in cybersecurity incident response or security operations.
• Experience as Incident Commander or lead for high-severity incidents.
• Ability to own and drive incidents from triage to remediation and post-incident review.
• Strong understanding of TCP/IP, firewall state tables, NAT, and network security events.
• Experience with DNS-based threats, DNS logs, and passive DNS.
• Strong Active Directory security knowledge and compromise response.

Responsibilities

• Own incident response for high-severity incidents from triage to containment and recovery.
• Validate escalations and determine true compromise vs. false positives.
• Investigate incidents across firewall, DNS, AD, cloud, and SIEM logs.
• Lead infrastructure-level security investigations and coordinate containment.
• Mentor colleagues and provide technical direction during investigations.
• Improve incident response processes, runbooks, and post-incident reviews.
• Collaborate with cross-functional teams to verify remediation and scope.

Skills

Incident Commander

Incident Response

SOC escalation

TCP/IP fundamentals

DNS security

Active Directory security

SIEM/logging

Mentoring

Tools

Splunk

Palo Alto

Fortinet

Check Point

Cisco

EDR/XDR platforms

Job description

StratITech is seeking a Principal Security Operations Engineer to lead cybersecurity incident response, security operations, and advanced investigations across a distributed enterprise. This leader will own high-severity incidents, work across firewalls, DNS, AD, cloud logs, and SIEM pipelines, and guide teams while remaining hands-on.

The role emphasizes technical credibility, mentorship, and continuous improvement of incident response practices, with collaboration across infrastructure,