> Markdown version of [/jobs/ext/4008397-staff-it-security-analyst-incident-response](https://www.wearedevelopers.com/jobs/ext/4008397-staff-it-security-analyst-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff IT Security Analyst-Incident Response

- **Company:** Western Governors University
- **Location:** Salt Lake City, UT, United States
- **Experience:** Expert
- **Salary:** $161,000.0 - $249,500.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Amazon Cloudfront, Amazon Elastic Compute Cloud, Audit Trail, Bash Shell, Software as a Service, Cloud Computing, Cyber Security, Databases, Continuous Integration, Data Security, Amazon DynamoDB, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Kali Linux, Machine Learning, Nmap, Open Source Technology, Platform as a Service (PAAS), Fortify (Software), Security Information and Event Management, Wireshark, Scripting, Mitre Att&ck, HybridCloud, Amazon Virtual Private Cloud (VPC), Cloudformation, Information Technology, Metasploit, Data Analytics, Nessus, Nexpose, Appscan, Cloudwatch, Security Orchestration, Automation & Response, Servicenow
- **Published:** October 29, 2026
- **Apply:** https://diversityjobs.com/career/18774572/Staff-It-Security-Analyst-Incident-Response-Utah-Salt-Lake-City

## About the Role

* Bachelor's Degree in IT Security, Computer Science, Engineering, or related field
 * 7 years of Information Security experience, including understanding of all security domains
 * Hands-on experience implementing MITRE ATT&CK Framework
 * Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events
 * Hands-on experience maintaining cloud resources using infrastructure-as-code (CloudFormation, CDK, etc.)
 * Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation
 * Experience with open-source security tools (i.e. Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, Eramba, etc)
 * Hands-on experience with AWS APIs, Lambda. DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, IAM
 * Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.)
 * Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services
 * Hands-on experience integrating security into the various stages of a CI/CD pipeline
 * Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions
 * Ability to lead in a fast-paced, multidisciplinary environment while using a methodical, data-driven approach to security and risk analysis
 * Excellent analytical, problem-solving, decision-making, and communication skills, with the ability to turn complex security challenges into practical solutions
 * Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA

Equivalent relevant experience performing the essential functions of this job may substitute for education degree requirements. Generally, equivalent relevant experience is defined as 1 year of experience for 1 year of education and is the discretion of the hiring manager.
Bonus Points

 * 15 years of Information Security experience, including understanding of all security domains
 * Strong experience with distance education and distance learning students

## Description

This is a lead-level, highly technical security role for someone who thrives at the center of complex cyber incidents. You will help lead incident response, threat detection, investigation, and remediation while also shaping the tools, automation, and security capabilities that strengthen WGU's defenses.

You will serve as a hands-on technical leader and escalation point for the IT Security team, working alongside security, infrastructure, engineering, and business partners. The right person brings deep technical expertise, strong investigative instincts, and the ability to turn emerging threats and real-world incidents into better detections, faster response, and stronger controls.
What You'll Do

 * Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.
 * Lead security content and detection use-case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.
 * Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.
 * Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
 * Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.
 * Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
 * Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands-on guidance during demanding security situations.