> Markdown version of [/jobs/ext/2055326-incident-response-analyst](https://www.wearedevelopers.com/jobs/ext/2055326-incident-response-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Incident Response Analyst

- **Company:** Cisco Systems, Inc.
- **Location:** Phoenix, AZ, United States
- **Experience:** Experienced
- **Salary:** $104,000.0 - $138,100.0
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Artificial Intelligence, Automation of Tests, Bash Shell, Cloud Computing, Code Review, Cyber Security, Continuous Integration, Intrusion Detection and Prevention, Python (Programming Language), Network Security, Package Management Systems, Phishing, Security Information and Event Management, Scripting, Delivery Pipeline, Mitre Att&ck, Gitlab, Git, Gitlab-ci, Kubernetes, Cybercrime, Splunk, Golang
- **Published:** August 14, 2026
- **Apply:** https://www.phoenixjobs.com/job.asp?id=3353339662&tx=JT9789TTT&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* Bachelor's Degree and 4+ years' of experience in security operations, incident response, or related technical role.
 * Working knowledge of incident response, alert triage, threat hunting, evidence handling, escalation workflows, and common attacker techniques.
 * Hands-on experience triaging and investigating alerts using SIEM, EDR, cloud, or network security tooling.
 * Experience with Git/GitLab workflows: branching, merge requests, code review, and CI/CD.
 * Experience with automation scripts, and make updates to playbooks, pipeline configurations, or modular tooling.
 * Experience with AI-assisted development, AI-powered security tooling, or agentic workflows, and ability to critically evaluate tool output before taking action.
 * Experience with MITRE ATT&CK, threat hunting methodology, malware triage, phishing analysis, vulnerability exploitation, attacker infrastructure analysis, or SOC performance metrics., * Strong written and verbal communication skills, including the ability to document investigations, write clear runbooks, and explain technical findings.
 * Experience with Splunk Enterprise Security, Splunk SPL, SOAR platforms, or large-scale security telemetry environments.
 * Experience building, maintaining, or reviewing SOC automation, enrichment workflows, SOAR playbooks, detection-as-code, reusable modules, or agentic investigation workflows.
 * Experience with GitLab CI/CD or similar pipeline systems, including pipeline configuration, automated testing, validation, deployment workflows, or approval gates.
 * Familiarity with cloud, container, Kubernetes, CI/CD runner, artifact registry, package management, or software supply chain security concepts.
 * Scripting or automation experience in Python, Bash, Go, or JavaScript.

## Description

Own the full arc of security incidents from first alert to documented resolution. This role combines hands-on security operations with AI-enabled investigation workflows and human-supervised agentic tooling to reduce analyst toil. Success looks like faster incident response, less noise, and a SOC that gets sharper every sprint!

 * Triage, investigate, and respond to security alerts across Splunk's enterprise and product environments.
 * Scope threats, collect evidence, and drive response actions using Splunk tooling and security platforms.
 * Partner with Detection Engineering to tune detections, cut false positives, and close coverage gaps.
 * Build and maintain SOC automation to eliminate repetitive work including scripts, playbooks, and enrichment workflows.
 * Apply AI-assisted and agentic tooling to accelerate investigation, enrichment, summarization, and repeatable analyst workflows with human oversight at every step.
 * Hunt threats, lead incident reviews, and contribute to cross-team investigations that raise SOC-wide quality., Note: As part of this role, you will be responsible for maintaining services in a FedRAMP-compliant environment and must be a U.S. Person (U.S. citizen). This position may perform work that the U.S. government has specified can only be performed by a U.S. citizen on U.S. soil.


## Related Videos

- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall)
- [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94)
- [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management)
- [Scoring 2000 Products per Request: Performance Pitfalls in Golang](https://www.wearedevelopers.com/videos/2073-scoring-2000-products-per-request-performance-pitfalls-in-golang)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss)