> Markdown version of [/jobs/ext/2565005-principal-analyst-security-operations](https://www.wearedevelopers.com/jobs/ext/2565005-principal-analyst-security-operations). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Analyst - Security Operations - **Company:** Expedia Inc. - **Location:** Seattle, WA, United States - **Salary:** $231,000.0 - $369,500.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Cloud Computing Security, Cyber Security, Decision Support Systems, Distributed Systems, Data Intelligence, Intrusion Detection and Prevention, Machine Learning, Security Information and Event Management, Information Technology, Security Orchestration, Automation & Response - **Published:** August 6, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=27fafb9d17032862 ## About the Role * Bachelor's degree in computer science, Information Security, Engineering, or a related technical field, or equivalent practical experience in security operations. * Extensive experience in security operations, including hands-on incident detection, investigation, and response across large-scale or complex environments. * Proven ownership of security operations across multiple services or domains, including responsibility for end-to-end monitoring, alerting, and incident handling processes. * Strong technical expertise in security tooling and infrastructure such as SIEM, EDR, log management, and security analytics platforms, and in interpreting complex telemetry for threat detection. * Familiarity with AI-driven systems, tools, or workflows in a security context, and the ability to work effectively with data, detections, and automation to improve operational outcomes., * Advanced experience operating global, large-scale security operations, including designing and refining detection strategies and incident response capabilities for highly distributed systems. * Demonstrated leadership in shaping the architecture and integration of security operations tools (for example SIEM, SOAR, EDR, ticketing, and automation platforms) across multiple technical domains. * Proven track record of driving operational excellence through continuous improvement of metrics, processes, automation, and data-driven decision making in security operations. * Experience designing, implementing, and tuning AI/ML-supported detections, triage workflows, or automated response actions, ensuring safe and effective use of AI/ML-enabled solutions in production security environments.Ability to influence senior technical and business stakeholders using clear, data-backed insights from security operations, and to mentor others in advanced investigation, threat hunting, and incident management practices. ## Description Our Cyber Security organization works across Expedia Group to protect the travelers, partners, employees, and platforms that power global travel. We build and operate resilient, intelligence-driven security capabilities spanning security operations, threat detection and response, security engineering, identity, data, and cloud security-reducing cyber risk while enabling trusted, secure innovation at scale. The Security Operations team partners with technology, product, and platform teams to detect, investigate, contain, and recover from threats while continuously improving the automation, telemetry, and operating models that keep Expedia Group secure. As part of this team, a Principal Security Operations leader will help set the technical direction for modern, AI-enabled defense capabilities, turn complex signals into decisive action, and strengthen a proactive, measurable security posture across the enterprise. In this role you will: * Lead complex security operations analyses to detect, investigate, and respond to sophisticated threats across Expedia Group's environments, driving clear, measurable risk reduction. * Design, optimize, and standardize security monitoring and incident response workflows, including runbooks, playbooks, and escalation paths, to improve speed, quality, and consistency of response. * Partner with engineering, incident management, and product teams to translate security findings into actionable technical requirements and remediation plans, influencing roadmaps across multiple domains. * Develop and maintain advanced analytics, detections, dashboards, and reporting that provide deep visibility into security posture, threat trends, and operational performance for senior stakeholders. * Provide technical leadership and mentorship across global security operations, shaping best practices for log management, alert tuning, investigation techniques, and use of SOAR/SIEM and related tooling. * Safely integrate and operate AI/ML-enabled solutions that improve detection, triage, and response outcomes, building familiarity with AI-driven systems, tools, or workflows and applying AI/ML concepts to real world security operations scenarios. ## Related Videos - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Finding the unknown unknowns: intelligent data collection for autonomous driving development](https://www.wearedevelopers.com/videos/519-finding-the-unknown-unknowns-intelligent-data-collection-for-autonomous-driving-development) - [Introduction to Azure Machine Learning](https://www.wearedevelopers.com/videos/368-introduction-to-azure-machine-learning) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Shipping Faster with Less: Render on Cloud Hosting, AI Workloads, and the Future of DevOps](https://www.wearedevelopers.com/videos/1894-shipping-faster-with-less-render-on-cloud-hosting-ai-workloads-and-the-future-of-devops) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [How to Become an AI Engineer](https://www.wearedevelopers.com/magazine/331-how-to-become-an-ai-engineer) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)