# Lead Cyber Security Engineer

**Company**: Western Governors University (WGU)
**Location**: Salt Lake City, UT
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Salary**: $161,000.00 - $249,500.00
**Category**: Security
**Industry**: Education

**Apply**: https://wgu.wd5.myworkdayjobs.com/en-US/External/job/Salt-Lake-City-UT/Staff-IT-Security-Analyst-Incident-Response_JR-026454?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_00663b5f-84e

## Description

We are seeking a Lead Cyber Security Engineer to join our team. As a lead-level, highly technical security role, you will help lead incident response, threat detection, investigation, and remediation while also shaping the tools, automation, and security capabilities that strengthen WGU's defenses.

**Responsibilities:**

- Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.

- Lead security content and detection use-case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.

- Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.

- Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.

- Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.

- Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.

- Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands-on guidance during demanding security situations.

**Requirements:**

- Bachelor's Degree in IT Security, Computer Science, Engineering, or related field

- 7 years of Information Security experience, including understanding of all security domains

- Hands-on experience implementing MITRE ATT&CK Framework

- Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events

- Hands-on experience maintaining cloud resources using infrastructure-as-code (CloudFormation, CDK, etc.)

- Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation

- Experience with open-source security tools (i.e. Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, Eramba, etc.)

- Hands-on experience with AWS APIs, Lambda. DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, IAM

- Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.)

- Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services

- Hands-on experience integrating security into the various stages of a CI/CD pipeline

- Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions

- Ability to lead in a fast-paced, multidisciplinary environment while using a methodical, data-driven approach to security and risk analysis

- Excellent analytical, problem-solving, decision-making, and communication skills, with the ability to turn complex security challenges into practical solutions

- Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA

**Benefits:**

- Medical, dental, vision, telehealth and mental healthcare

- Health savings account and flexible spending account

- Basic and voluntary life insurance

- Disability coverage

- Accident, critical illness and hospital indemnity supplemental coverages

- Legal and identity theft coverage

- Retirement savings plan

- Wellbeing program

- Discounted WGU tuition

- Flexible paid time off for rest and relaxation with no need for accrual

- Flexible paid sick time with no need for accrual

- 11 paid holidays

- Other paid leaves, including up to 12 weeks of parental leave

## Skills

### Required
- MITRE ATT&CK Framework
- SIEM content security rules
- CloudFormation
- CDK
- Bash
- Python
- AWS APIs
- Lambda
- DynamoDB
- EC2
- VPC
- CloudFront
- CloudTrail
- CloudWatch
- IAM
- CISSP
- GIAC
- ISACA
- CEH

### Nice to have
- 15 years of Information Security experience
- Strong experience with distance education and distance learning students

---

Source: [Apply at wgu.wd5.myworkdayjobs.com](https://wgu.wd5.myworkdayjobs.com/en-US/External/job/Salt-Lake-City-UT/Staff-IT-Security-Analyst-Incident-Response_JR-026454?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)