Description
We are seeking a Lead Cyber Security Engineer to join our team. As a lead-level, highly technical security role, you will help lead incident response, threat detection, investigation, and remediation while also shaping the tools, automation, and security capabilities that strengthen WGU's defenses.
Responsibilities:
- Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.
- Lead security content and detection use-case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.
- Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.
- Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
- Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.
- Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
- Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands-on guidance during demanding security situations.
Requirements:
- Bachelor's Degree in IT Security, Computer Science, Engineering, or related field
- 7 years of Information Security experience, including understanding of all security domains
- Hands-on experience implementing MITRE ATT&CK Framework
- Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events
- Hands-on experience maintaining cloud resources using infrastructure-as-code (CloudFormation, CDK, etc.)
- Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation
- Experience with open-source security tools (i.e. Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, Eramba, etc.)
- Hands-on experience with AWS APIs, Lambda. DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, IAM
- Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.)
- Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services
- Hands-on experience integrating security into the various stages of a CI/CD pipeline
- Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions
- Ability to lead in a fast-paced, multidisciplinary environment while using a methodical, data-driven approach to security and risk analysis
- Excellent analytical, problem-solving, decision-making, and communication skills, with the ability to turn complex security challenges into practical solutions
- Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA
Benefits:
- Medical, dental, vision, telehealth and mental healthcare
- Health savings account and flexible spending account
- Basic and voluntary life insurance
- Disability coverage
- Accident, critical illness and hospital indemnity supplemental coverages
- Legal and identity theft coverage
- Retirement savings plan
- Wellbeing program
- Discounted WGU tuition
- Flexible paid time off for rest and relaxation with no need for accrual
- Flexible paid sick time with no need for accrual
- 11 paid holidays
- Other paid leaves, including up to 12 weeks of parental leave