Senior Incident Response Analyst — AI-Driven SOC

Cisco Systems, Inc.; Seattle (WA); On-site; USD 117,000 - 191,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) with company match

Paid parental leave

Short/long-term disability

Basic life insurance

Paid time off

Volunteer time off

Job summary

Cisco Systems, Inc. is seeking a security operations professional to join a 24/7 global SOC, focusing on incident response, triage, and agentic tooling.

You will shape how agents operate with human oversight and help drive containment and analysis across Cisco products and customers. You will collaborate with Splunk-enabled detection and tools teams, tune detections, and automate repeatable investigations using scripts, playbooks, and Git workflows.

Qualifications

• 4+ years of experience in security operations, incident response, or security monitoring.
• Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud.
• Experience writing and troubleshooting security searches in SPL, KQL, SQL or similar.
• Experience modifying Python or Bash automation, YAML/JSON, and Git workflows.
• Experience using LLM-based or agentic tools and verifying outputs.

Responsibilities

• Triage, investigate, and respond to alerts across Splunk's product and enterprise environments.
• Develop and harden agentic tooling behind investigations; build, test, and review runbooks and prompts.
• Collaborate with Detection Engineering to tune detections and reduce false positives.
• Evaluate agent outputs against raw evidence and maintain audit trails and defenses.
• Contribute to MCP servers, SOAR playbooks, and integrations to automate recurring procedures.

Skills

Security operations

Incident response

SIEM/EDR

Python/Bash automation

LLM-based tools

Tools

Splunk Enterprise Security

Splunk SOAR

Splunk AI Assistant

GitLab

Job description

Cisco Systems, Inc. is seeking a security operations professional to join a 24/7 global SOC, focusing on incident response, triage, and agentic tooling.

You will shape how agents operate with human oversight and help drive containment and analysis across Cisco products and customers. You will collaborate with Splunk-enabled detection and tools teams, tune detections, and automate repeatable investigations using scripts, playbooks, and Git workflows.