Incident Response Analyst – Agentic SOC

Cisco

. Investigate incidents in Splunk’s global 24/7 SOC .

Posted 10/28/2026full-timeRemote • United StatesMid-LevelSenior💰 $116,600 - $147,900 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations and incident response, with a strong focus on alert triage, investigation, and the use of Splunk tools. Proficient in developing and maintaining automated workflows and evaluating security tooling effectiveness.

Highest-signal resume keywords

Security Operations ExperienceIncident Response ProcessesSPL Query Language ProficiencyPython Automation SkillsSplunk Enterprise Security Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Alert TriageIncident InvestigationSecurity MonitoringSPLKQLSQLPythonBashYAMLJSON

Soft Skills

Clear Written Communication

Tools & Technologies

Splunk Enterprise SecuritySplunk SOARGitLabEDR ToolsCloud Tooling

Industry Keywords

SIEMTCP/IPDNSHTTPAI Security Risks

Tech Stack

Tools & technologies

CloudDNSPythonSplunkSQLTCP/IP

About the role

Key responsibilities & impact

Investigate incidents in Splunk’s global 24/7 SOC
Build, evaluate, and harden agentic tooling used in investigations
Triage, investigate, and respond to alerts across Splunk product and enterprise environments
Use agentic triage and enrichment, validate verdicts, and scope incidents with Splunk Enterprise Security, Mission Control, SPL, EDR, identity, and cloud tooling
Collect evidence, document findings, and drive containment of critical issues
Partner with Detection Engineering to tune detections, reduce false positives, and close coverage or data-quality gaps
Build and maintain agent skills, prompts, MCP servers, SOAR playbooks, and enrichment lookups
Manage GitLab merge requests and code reviews
Convert recurring manual procedures into tested, documented agent workflows and maintain runbooks
Evaluate tooling using real-alert test cases, accuracy and false-verdict tracking, approval gates, autonomy limits, audit trails, and security defenses
Run pre-release Splunk security AI as Customer Zero
Deliver structured findings to Enterprise Security, SOAR, and AI product teams
Work a four-day schedule on either Wednesday–Saturday or Sunday–Wednesday, 12:00 p.m.–10:00 p.m. Central Time

Requirements

What you’ll need

4+ years of experience in security operations, incident response, or security monitoring
Experience with alert triage and investigation using SIEM, EDR, identity, and cloud tooling
Knowledge of incident response processes and common attacker techniques
Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud
Experience writing and troubleshooting security searches in SPL, KQL, SQL, or a similar query language
Experience reading and modifying Python or Bash automation
Experience with YAML/JSON configuration and playbooks using Git workflows, branches, merge requests, and code review
Experience using LLM-based or agentic tools and verifying outputs against raw evidence
Experience with Splunk Enterprise Security 8 (Mission Control), Splunk SOAR, or Splunk AI Assistant preferred
Experience building agent tools or integrations, including LLM tool calling, MCP servers, or RAG preferred
Experience designing evaluations for LLM or agent output and running them in GitLab CI/CD pipelines preferred
Knowledge of AI security risks, including OWASP Top 10 for LLM Applications, prompt injection, and model data-handling controls preferred
Clear written communication for investigation notes, runbooks, and explanations of incorrect agent conclusions

Benefits

Comp & perks

Medical, dental and vision insurance
401(k) plan with a Cisco matching contribution
Paid parental leave
Short- and long-term disability coverage
Basic life insurance
Cisco restricted stock unit grants may be available
10 paid holidays per full calendar year
1 floating holiday for non-exempt employees
1 paid day off for employee’s birthday
Paid year-end holiday shutdown
4 paid days off for personal wellness
16 days of paid vacation per full calendar year for non-exempt employees
Flexible vacation time off program for exempt employees
80 hours of sick time off provided on hire date and each January 1st thereafter
Up to 80 hours of unused sick time carried forward annually
Additional paid time away for critical or emergency family issues
Optional 10 paid volunteer days per full calendar year
Annual bonuses for non-sales roles, subject to Cisco policies
Performance-based incentive pay for sales-plan employees