IT Security Engineer I

The Security Operations Engineer serves as a critical first line of defense against cyber threats, responsible for continuous monitoring of the university’s security posture, incident detection and response, and maintaining Security Operations Center capabilities. This position plays a vital role in identifying, analyzing, and mitigating cybersecurity incidents to protect and strengthen the university’s security infrastructure, ensuring rapid identification and containment of security threats.

The role is with the Security Incident Operations Center (SIOC) team and works to optimize detection capabilities, improve response, and maintain proactive threat response protocols. The security operations engineer ensures that the university’s IT assets remain resilient against evolving security threats while delivering high-quality service to stakeholders across the institution. About Us

This role supports the implementation and maintenance of cybersecurity solutions that protect organizational systems and networks. Assists with vulnerability management, basic risk assessments and the configuration of security tools. Resolves routine issues and supports secure infrastructure operations. Worksite Description, * Occasional after-hours work for incident response or change management work in designated maintenance windows

• Participation in on-call rotation
• Occasional travel required for training, conferences, or other events

• Requires a high school diploma (or equivalent) and seven years of relevant experience in network security or network engineering including experience and knowledge of network protocols. Requirements may be met through a combination of work experience and education., * 3-5 years of experience in security operations or incident response
• Strong knowledge of SIEM platforms (Splunk, IBM QRadar, ArcSight, or similar)
• Experience with network protocols, log analysis, and forensic techniques
• Understanding of common attack vectors and threat actor tactics
• Proficiency in scripting languages (Python, PowerShell, Bash)
• Knowledge of Windows and Linux operating systems
• Familiarity with security frameworks (NIST, MITRE ATT&CK)
• Security certifications (Security+, GCIH, GCFA, CySA+)
• Experience with cloud security monitoring (AWS, Azure, GCP)
• Knowledge of threat intelligence platforms
• Experience with security orchestration and automation tools
• Understanding of malware analysis techniques
• SIEM administration and log analysis
• Network traffic analysis (Wireshark, tcpdump)
• Endpoint detection and response (EDR) tools
• Vulnerability scanning and assessment tools
• Incident response and digital forensics
• Security information correlation and analysis
• Strong analytical and problem-solving abilities
• Excellent written and verbal communication skills
• Ability to work under pressure and handle multiple priorities
• Strong attention to detail and accuracy
• Collaborative team player with cross-functional experience
• Continuous learning mindset and adaptability to new technologies, Candidates must be legally authorized to work in the U.S. on an ongoing basis without sponsorship.