Staff IT Security Analyst-Incident Response

Western Governors University; Salt Lake City (UT); On-site; USD 161,000 - 250,000; Full time

Benefits offered by this job

Bonuses eligible

Health/dental/vision insurance

HSA/FSA options

Wellbeing program

Tuition assistance

11 paid holidays

Parental leave

Job summary

WGU in Salt Lake City is seeking a senior Information Security professional to lead incident response, threat detection, and cloud security initiatives across AWS and other platforms. This full-time, in-office role focuses on building security automation, developing detection logic, and mentoring analysts while advancing defenses in a fast-paced environment.

You will architect cloud analytics, align with MITRE ATT&CK, and drive CI/CD security integration.

Qualifications

• Bachelor’s degree or higher in IT Security, CS, Engineering, or related field
• 7+ years of information security experience across domains
• Hands-on MITRE ATT&CK implementation experience
• Experience creating SIEM content rules to detect malicious or abnormal events
• Hands-on with infrastructure‑as‑code and cloud resources (e.g., CloudFormation, CDK)
• Expert scripting (Bash, Python) with automation focus
• Experience with open-source security tools (Kali, Nessus, Burp, NMap, Wireshark)
• Hands-on AWS API usage (Lambda, DynamoDB, EC2, IAM, CloudWatch)
• Security certifications (CISSP, GIAC, ISACA, CEH)
• Knowledge of cloud and data security in AWS
• CI/CD security integration experience
• SaaS/PaaS enterprise security architecture
• Data-driven risk analysis and strong communication
• Regulatory knowledge including GDPR/CCPA

Responsibilities

• Lead complex incident response and investigation efforts
• Develop detection use-cases aligned to MITRE ATT&CK
• Architect cloud threat analytics across AWS and other clouds
• Design and implement SIEM content security rules
• Automate security across cloud infra, CI/CD, data security
• Identify gaps and lead security solutions from requirements to operation
• Mentor analysts and lead in demanding security situations
• Collaborate with ServiceNow integrations and cross-team efforts

Skills

MITRE ATT&CK Framework

SIEM content development

Cloud security

Python/Bash scripting

Data analysis

Communication

Education

Bachelor’s Degree in IT Security, Computer Science, Engineering, or related field

Security certifications (CISSP, GIAC, ISACA, CEH, etc.)

Tools

Kali

Nessus

Burp Suite

NMap

Wireshark

Metasploit

Job description

If you’re passionate about building a better future for individuals, communities, and our country—and you’re committed to working hard to play your part in building that future—consider WGU as the next step in your career.

Driven by a mission to expand access to higher education through online, competency-based degree programs, WGU is also committed to being a great place to work for a diverse workforce of student-focused professionals. The university has pioneered a new way to learn in the 21st century, one that has received praise from academic, industry, government, and media leaders. Whatever your role, working for WGU gives you a part to play in helping students graduate, creating a better tomorrow for themselves and their families.

Pay Range: $161,000.00 - $249,500.00

What You'll Do

• Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.
• Lead security content and detection use‑case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.
• Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.
• Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
• Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure‑as‑code, data security, DLP, encryption, and security tooling.
• Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
• Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands‑on guidance during demanding security situations.

What You'll Bring

• Bachelor’s Degree in IT Security, Computer Science, Engineering, or related field
• 7 years of Information Security experience, including understanding of all security domains
• Hands‑on experience implementing MITRE ATT&CK Framework
• Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events
• Hands‑on experience maintaining cloud resources using infrastructure‑as‑code (CloudFormation, CDK, etc.)
• Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation
• Experience with open‑source security tools (i.e. Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack‑ng, Eramba, etc)
• Hands‑on experience with AWS APIs, Lambda, DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, IAM
• Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.)
• Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services
• Hands‑on experience integrating security into the various stages of a CI/CD pipeline
• Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed‑technology security solutions
• Ability to lead in a fast‑paced, multidisciplinary environment while using a methodical, data‑driven approach to security and risk analysis
• Excellent analytical, problem‑solving, decision‑making, and communication skills, with the ability to turn complex security challenges into practical solutions
• Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA

Equivalent relevant experience performing the essential functions of this job may substitute for education degree requirements. Generally, equivalent relevant experience is defined as 1 year of experience for 1 year of education and is the discretion of the hiring manager.

Bonus Points

• 15 years of Information Security experience, including understanding of all security domains
• Strong experience with distance education and distance learning students

What to Expect

At WGU, our mission drives everything we do, including how we hire. Our interview experience is designed to give qualified candidates the opportunity to show their best work through meaningful conversations and collaboration.

We thoughtfully review every application and invite forward the candidates whose experience and potential best align with the role and our mission.

• Talent Partner introductory call
• Hiring Leader Interview
• Executive Leadership Interview

Work Location

This is a full‑time, in‑office position requiring five days per week in our Salt Lake City, Utah or Raleigh, North Carolina office, designed to foster the collaboration and connection that fuel our best work.

Visa Sponsorship

While we welcome applicants from all backgrounds, WGU is not able to provide visa sponsorship for this role.

Travel Requirement

This position requires occasional travel of up to 20%, including required attendance at designated company summits (typically one to two per year). Additional travel may include conferences, visits to company locations, and other business‑related events as needed. Additional travel may be assigned as needed to support business requirements.

#LI-AW2

Additional Information

Full‑time Regular Positions (classified as regular and working 40 standard weekly hours): This is a full‑time, regular position (classified for 40 standard weekly hours) that is eligible for bonuses; medical, dental, vision, telehealth and mental healthcare; health savings account and flexible spending account; basic and voluntary life insurance; disability coverage; accident, critical illness and hospital indemnity supplemental coverages; legal and identity theft coverage; retirement savings plan; wellbeing program; discounted WGU tuition; and flexible paid time off for rest and relaxation with no need for accrual, flexible paid sick time with no need for accrual, 11 paid holidays, and other paid leaves, including up to 12 weeks of parental leave.

• Disclaimer: The job posting highlights the most critical responsibilities and requirements of the job. It’s not all-inclusive.
• Accommodations: Applicants with disabilities who require assistance or accommodation during the application or interview process should contact our Talent Acquisition team at [e-mail].
• Equal Employment Opportunity: All qualified applicants will receive consideration for employment without regard to any protected characteristic as required by law.