Security Operations

• Monitor client environments continuously for cybersecurity threats using SIEM, endpoint detection and response, identity protection, and email security platforms
• Own the live alert queue during each shift; triage detections, determine scope and severity, and execute or authorize appropriate responses
• Conduct structured shift handoffs and ensure every detection, investigation, and client commitment has a clear owner
• Investigate account compromise, business email compromise, social engineering, malware, and ransomware incidents
• Analyze servers, workstations, identities, and other potentially compromised assets
• Contain and remediate confirmed threats using automation workflows, scripts, policies, playbooks, and platform controls
• Escalate incidents according to the incident response plan when they exceed the analyst’s authority or expertise
• Provide timely, professional incident communications to clients and internal stakeholders
• Perform scheduled vulnerability scanning across client environments
• Support CMMC and NIST SP 800-171 compliance objectives by producing required monitoring evidence, logs, and reports
• Review overnight Tines automation logs, validate automated actions, and remediate or escalate exceptions
• Respond to overnight escalations while on call and document all actions
• Identify repetitive manual work and false positives for automation or detection tuning
• Test and provide structured feedback on new detections and automation workflows
• Track and document all work in the ticketing system
• Meet KPIs, support peers across both shifts, and escalate assignments when necessary

Security Operations Center (SOC) Analyst

• Build and own the end-to-end vendor onboarding compliance process, including DPA and SOC 2/GDPR data compliance reviews, subprocessor list updates, and customer notifications
• Serve as the internal owner and point of contact for external GRC vendors
• Manage GRC vendor intake, ticketing, SLAs, quality review, and performance metrics
• Ensure teams and systems are integrated into Clay's compliance tools and framework, including DSAR processes
• Partner with Security, Legal, Marketing, Data, and other stakeholders to scale privacy-by-design practices
• Build and complete compliance reviews for new data sets and vendor compliance
• Create operational processes and systems from scratch to scale compliance work across the company
• Own compliance programs end-to-end
• Assist with security and privacy questionnaires from prospective and existing customers
• Work at the intersection of engineering, security, legal, and business teams

Product Operations, Security & Compliance

• Monitor and operate access control, CCTV, intrusion detection, alarms, radios, and telephony systems
• Receive, assess, document, and respond to security incidents in real time
• Dispatch security personnel and coordinate emergency response when required
• Maintain accurate incident logs, reports, and shift documentation
• Perform badge verification, visitor access coordination, and credential checks
• Communicate with Government personnel, first responders, and internal stakeholders
• Escalate incidents according to SOPs, post orders, and contractual requirements
• Maintain situational awareness across multiple facilities and systems
• Support continuity of operations during emergencies or elevated threat conditions
• Adhere to security, safety, and compliance requirements
• Report to the Site Lead
• Perform other duties as assigned

Security Operations Center Specialist

• Monitor and operate access control, CCTV, intrusion detection, alarm, radio, and telephony systems
• Receive, assess, document, and respond to security incidents in real time
• Dispatch security personnel and coordinate emergency response
• Maintain incident logs, reports, and shift documentation
• Perform badge verification, visitor access coordination, and credential checks
• Communicate with Government personnel, first responders, and internal stakeholders
• Escalate incidents according to SOPs, post orders, and contractual requirements
• Maintain situational awareness across multiple facilities and systems
• Support continuity of operations during emergencies or elevated threat conditions
• Adhere to security, safety, and compliance requirements
• Report to the Site Lead
• Work within a secure indoor operations center monitoring screens and managing multiple systems

• Perform complex problem analysis and resolution across cloud security, Identity and Access Management (IAM), infrastructure protection, cyber recovery, Disaster Recovery (DR) engineering, application security, DevSecOps, security tooling and automation, and data loss prevention
• Execute increasingly complex day-to-day Cyber Defense Engineering activities within the assigned domain
• Design and construct moderately complex interfaces between ERP and legacy systems
• Provide production support by troubleshooting issues, proposing solutions, developing and testing fixes, and migrating solutions
• Use back-end programming languages and front-end script languages to optimize performance, scalability, and security
• Code programming logic for new or existing software solutions and applications
• Install, configure, develop, design workflows, monitor, and upgrade assigned software products
• Maintain up-to-date records of issues with existing code
• Monitor application quality and performance through testing and maintenance
• Develop and maintain applications for business processes and systems
• Ensure adherence to development best practices and standards within the immediate group
• Represent IT on particular projects when required
• Identify opportunities for process and procedure enhancements and communicate them to other departments
• Suggest viable solutions for issues with existing software
• Forecast, model, and utilize advanced analytical tools
• Perform other assigned duties

Lead Cyber Operations Engineer - Global Industrial

• Monitor all U.S. Bank and U.S. Bancorp systems worldwide from the Security Control Center
• Monitor and respond to fire, life safety, intrusion, and asset-protection alarms using the Genetec system
• Document and communicate alarm interactions to appropriate parties
• Coordinate responses with internal and external agencies, including police, fire, EMS, and guard services
• Process communications from internal personnel, law enforcement, employees, customers, and vendors
• Assist with and document alarm testing
• Assist alarm system users and field technicians with system use and testing; identify and escalate service or training issues
• Interact with Corporate Real Estate divisions, including Senior Management, Investigations, Guard Services, Facilities, and Engineering
• Channel communications between internal business lines and Corporate Security and Real Estate staff
• Place security service calls for U.S. Bancorp facilities, dispatch vendors, and help identify issues
• Use the Enterprise Notification System to alert employees about incidents affecting safety or business operations
• Escalate emergencies according to established criteria and provide timely incident resolution
• Prepare thorough, concise written incident documentation using appropriate grammar and style
• Operate computer systems and software including Microsoft Office, Windows NT, and proprietary applications
• Adapt to operational changes and solve problems using available resources
• Perform miscellaneous tasks supporting organizational protection of people, property, and assets

Security Control Center Operator

• Support 24x7 monitoring, detection, and management of advanced cyber threats
• Execute operational processes supporting responses to identified security incidents
• Perform deep-dive incident analysis by correlating data from multiple sources to determine impact on critical systems or datasets
• Interpret SIEM output, incident reporting platforms and mailboxes, and phone calls to identify potential security incidents
• Handle incidents according to playbooks and SOPs
• Identify security problems requiring mitigating controls and advise on remediation actions
• Analyze threat intelligence to assess risk and adapt defenses
• Provide subject matter expertise on network-based attacks, intrusion methodologies, and threat management
• Escalate complex incidents and collaborate with Threat Management team members
• Use AI/ML-based tools to detect anomalies, automate triage, and improve threat intelligence
• Provide input on leveraging AI, ML, and SOAR capabilities to improve CSOC efficiency and accuracy
• Stay current on cybersecurity trends, threat actors, and AI/ML advancements
• Tune security policies and maintain visibility into cloud and endpoint environments
• Support continuous improvement of the organization’s security posture
• Identify and support automation use cases, including AI/ML enhancements
• Collaborate across the organization to provide SOC enhancement capabilities through automation and AI
• Work initial temporary orientation and qualification hours Monday–Friday, 7:00am–3:30pm ET
• Work final assigned weekday night shift Monday–Friday, 11:00pm–7:30am ET

Cyber Security, SOC Analyst – Weekend Nights

• Evaluate, respond to, and mitigate alerts from SIEM and cybersecurity products including NGFWs, IDS/IPS, antivirus, web application firewalls, NAC solutions, and EDR
• Use and apply SIEM and EDR security technologies
• Tune SIEM events to reduce false positives
• Extract indicators of compromise and behavioral characteristics from malicious samples and implement mitigation through sandboxing
• Scope events and determine appropriate remediation steps
• Demonstrate subject matter expertise in one or more SOC functions
• Perform operational support for the institution as a representative of the security organization
• Provide technical evaluation and analysis to improve the organization’s security posture
• Review information and logs, execute defined tasks, analyze requirements, and create documentation
• Conduct investigations, data loss prevention, data manipulation, and coordination of activities
• Address or mitigate risks and vulnerabilities
• Review and define controls
• Advise on complex security procedures and products for clients, security administrators, and network operations
• Participate in enforcement of controls addressing security risks and threats
• Share knowledge with staff
• Conduct security assessments and information security routines
• Investigate and recommend corrective actions for data security

Security Analyst – SOC

• Serve as the SOC engineer for SIEM design and related components, ensuring confidentiality, integrity, and availability of logs
• Implement and manage automated alerting systems for timely detection and response to security incidents
• Manage, maintain, configure, update, and integrate security systems and infrastructure
• Maintain security tools and hardware, troubleshoot issues, and perform software updates
• Integrate threat intelligence with internal data to enhance detection and adapt defense strategies
• Develop SIEM content including use cases, dashboards, false-positive tuning, SLA/KPI reporting, and log-source configuration
• Leverage SOAR technologies and playbooks to automate incident-response workflows
• Review logging information-flow strategies and create work plans for log onboarding
• Correlate events to support SOC response requirements
• Provide incident response, forensic, troubleshooting, and security support requiring event details
• Support SOC automation initiatives and apply human analysis as needed
• Implement event and logging requirements in security projects across the business
• Participate in threat-hunting tabletop exercises
• Maintain knowledge of threats, vulnerabilities, and mitigations
• Support the CISO, management team, and executive leadership
• Support SOC Analysts Tiers 1–3 and act as an escalation point for complex investigations
• Integrate advanced security operations, cybersecurity tools, intrusion detection, and secure networks with the SIEM platform
• Perform other duties as assigned

Security Operations Engineer, Threat Hunting

• Lead enterprise technology operations including infrastructure, cloud, networking, endpoint management, collaboration platforms, telecommunications, and end-user support
• Establish service levels, operational metrics, accountability, monitoring, and continuous improvement practices
• Ensure technology services are reliable, scalable, secure, and responsive to business needs
• Develop and execute infrastructure and technology operations roadmaps and lifecycle plans
• Establish incident, problem, and change management practices
• Lead major technology incidents and communicate with business and executive leadership
• Lead and provide accountability for the cybersecurity program
• Establish and maintain security policies, standards, processes, and operational controls
• Oversee security monitoring, vulnerability management, identity and access management, incident response, and security remediation
• Partner with Legal, Internal Audit, Risk, business leaders, and external security partners on assessments and remediation
• Ensure cybersecurity incident response and recovery plans are documented, tested, and maintained
• Support security awareness and education across the company
• Own the operational performance of Microsoft Azure, Microsoft 365, networking, servers, endpoints, backup and recovery, and related infrastructure platforms
• Develop infrastructure strategies and lead modernization initiatives
• Lead Service Desk and Field Support organizations supporting corporate offices, sales environments, and field operations
• Improve service levels, response and resolution times, knowledge management, and customer satisfaction
• Ensure employee onboarding, technology provisioning, offboarding, asset management, and endpoint lifecycle processes
• Own technology disaster recovery planning, testing, and readiness
• Define recovery objectives, recovery procedures, and backup strategies for critical technology platforms
• Conduct recovery exercises and remediate identified gaps
• Partner with business leadership on technology resilience and continuity planning
• Manage strategic vendors and managed service providers
• Develop and manage operating budgets and technology investment recommendations
• Participate in contract negotiations, technology lifecycle planning, and vendor strategy
• Lead and develop the Technology Operations and Security organization of approximately 14 technology professionals
• Establish roles, accountability, performance expectations, and development plans
• Develop managers and technical leaders and build internal capabilities

Security Operations jobs in United States

Security Operations Center (SOC) Analyst

Product Operations, Security & Compliance

Security Operations Center Specialist

Security Operations Center Specialist

Lead Cyber Operations Engineer - Global Industrial

Security Control Center Operator

Cyber Security, SOC Analyst – Weekend Nights

Security Analyst – SOC

Security Operations Engineer, Threat Hunting

Director, Technology Operations – Security