Security Operations Engineer

Cisco

. Manage, triage, and validate container, host, and cloud infrastructure findings across enterprise scanners .

Posted 10/12/2026full-timeRemote • United StatesMid-LevelSenior💰 $128,600 - $184,900 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Security Operations, Incident Response, and Cloud Security, with a strong focus on vulnerability management, threat detection, and automation using Python and AI/LLM tools. Proven ability to lead incident response efforts, manage cross-functional teams, and ensure compliance with industry standards.

Highest-signal resume keywords

Security Operations Center ExperienceCloud Security ExpertiseIncident Response ManagementPython Automation and ScriptingVulnerability Lifecycle Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Vulnerability ManagementThreat HuntingIncident CommandSecurity Log AnalysisMITRE ATT&CK FrameworkCloud Architecture (AWS, Azure, GCP)Forensics CoordinationAutomated DetectionsScripting (Python)Container Security

Soft Skills

Cross-Functional LeadershipHigh-Pressure Decision MakingEffective CommunicationCollaboration

Tools & Technologies

SIEM Platforms (Splunk)REST APIsKubernetesCloud APIs (Jira, GitHub)Endpoint Auditing Tools

Certifications & Qualifications

CISSPAWS Certified Security – SpecialtyGIAC (GCIH/GCFA/GCDA)Splunk Core Certified Power User/Admin

Industry Keywords

NIST SP 800-61ISO StandardsCVSSEPSSMicroservice EnvironmentsPostmortem AuthoringOperational AutomationTechnical Control Evidence

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformKubernetesLinuxPythonSplunk

About the role

Key responsibilities & impact

Manage, triage, and validate container, host, and cloud infrastructure findings across enterprise scanners
Prioritize vulnerabilities, validate false positives, and enforce remediation SLAs across product engineering queues
Serve as Incident Commander during critical-severity SBG security incidents
Lead cross-functional triage calls and direct containment and eradication strategies
Coordinate forensics and facilitate postmortem retrospectives
Analyze multi-source telemetry in enterprise SIEMs and endpoint auditing tools
Detect adversary tactics mapped to the MITRE ATT&CK framework
Execute hypothesis-driven threat hunts
Convert threat-hunt findings into automated detections and alerting rules
Partner with governance teams to collect, validate, and orchestrate technical control evidence for compliance audits
Engineer automated workflows, runbooks, and Python scripts to eliminate operational bottlenecks and technical debt
Leverage AI/LLM tooling and REST APIs to accelerate triage workflows and enhance threat analysis

Requirements

What you’ll need

4+ years of hands-on experience in a dedicated Security Operations Center, Cloud Security, or Incident Response role within a modern enterprise environment
Experience with AWS, Azure, and GCP cloud architecture
Experience with vulnerability lifecycle management and operating/tuning vulnerability management pipelines
Understanding of CVSS and EPSS scoring
Experience driving remediation across complex microservice environments
Experience managing high-pressure incident response workflows following NIST SP 800-61 / ISO standards
Experience querying, correlating, and interpreting security logs in enterprise SIEM platforms, including Splunk, and Linux system logs
Experience authoring postmortems and SOPs
Experience leveraging AI/LLMs for alert enrichment, ticket classification, or operational automation
Bachelor’s degree in Cybersecurity, Information Systems, or equivalent experience (preferred)
Experience with Python automation and scripting
Experience with physical data center security
Experience consuming REST APIs, including Jira, GitHub, and cloud APIs
Familiarity with Kubernetes and container security scanners such as Wiz or Falco
Industry-recognized credentials such as CISSP, AWS Certified Security – Specialty, GIAC (GCIH/GCFA/GCDA), or Splunk Core Certified Power User/Admin
Experience and availability to participate in a distributed team on-call rotation

Benefits

Comp & perks

Medical, dental and vision insurance
401(k) plan with a Cisco matching contribution
Paid parental leave
Short- and long-term disability coverage
Basic life insurance
Cisco restricted stock unit grants may be available
10 paid holidays per full calendar year
1 floating holiday for non-exempt employees
1 paid day off for employee’s birthday
Paid year-end holiday shutdown
4 paid days off for personal wellness
16 days of paid vacation per full calendar year for non-exempt employees
Flexible vacation time off program with no defined limit for eligible exempt employees
80 hours of sick time on hire date and each January 1st thereafter
Up to 80 hours of unused sick time carried forward
Additional paid time away for critical or emergency family issues
Optional 10 paid volunteer days per full calendar year
Annual bonuses for non-sales roles, subject to Cisco policies
Continuous learning, mentorship, and career growth opportunities