Cybersecurity Operations Engineer

Granicus•Remote,

23h•$93,800 - $120,000•Remote

About The Position

Granicus is seeking a Cybersecurity Operations Engineer to operate, monitor, and continuously improve cybersecurity controls protecting a mission-critical SaaS product hosted in AWS and subject to FedRAMP and CJIS security requirements. This is one of two hands-on individual contributor positions responsible for preserving the confidentiality, integrity, and availability of the product and its data. The role operates endpoint protection, centralized security logging and analytics, vulnerability management, and related cloud security controls; monitors the environment; investigates security events; supports incident response; performs operational activities for the enterprise data protection program; and contributes to other cybersecurity initiatives. The position reports to the Cybersecurity Operations Lead within the Global Cyber Defense organization. The role must be based in the United States, and the employee must possess or be able to obtain and maintain the personnel screening and access authorization required for CJIS-regulated environments. The engineer performs day-to-day security operations and engineering for the designated SaaS product and supporting AWS environment, applies FedRAMP, NIST SP 800-53, CJIS Security Policy, and Granicus requirements, and supports continuous monitoring, control testing, audit evidence, corrective actions, and authorization maintenance. Responsibilities include operating security platforms and telemetry pipelines; performing vulnerability scans and coordinating remediation; monitoring and investigating alerts; supporting incident response and maintaining auditable records; and improving operational readiness, runbooks, and team coverage. The role also executes data protection activities, including supporting controls for data discovery, classification, handling, access, encryption, monitoring, retention, and secure disposal. It partners with Privacy, Legal, Product, Engineering, Cloud, Compliance, and business teams; provides practical security input on technical and operational decisions; and uses approved AI-assisted analysis, scripting, APIs, query languages, and automation to improve security processes while protecting sensitive data and maintaining human validation and auditability. This is a U.S.-based role at a remote-first company. The pay range is USD $93,800–$120,000 per year. Granicus describes its benefits as a comprehensive and flexible package supporting well-being, growth, and work-life balance.

Requirements

At least 3 years of experience in cybersecurity engineering, security operations, cloud security, incident response, or related roles.
Demonstrated hands-on experience operating security monitoring, endpoint protection, vulnerability management, and incident response capabilities in an AWS-hosted production cloud or SaaS environment.
Experience triaging and investigating security events and supporting incidents from initial detection through containment, recovery, and lessons learned.
Experience working with cloud and application logs, security analytics, detection queries, case management, and vulnerability remediation workflows.
Strong knowledge of security operations and security engineering for cloud-hosted SaaS products, including practical understanding of AWS environments and the cloud shared-responsibility model.
Working knowledge of FedRAMP continuous monitoring, NIST SP 800-53 security controls, the CJIS Security Policy, and regulated cloud operational expectations.
Hands-on ability to operate endpoint detection and response, centralized logging and security analytics, vulnerability management, and cloud security monitoring capabilities.
Strong understanding of AWS identity, networking, compute, storage, logging, encryption, key management, and security-relevant configuration practices.
Ability to maintain reliable security telemetry pipelines, including log collection, parsing, normalization, enrichment, retention, access, and quality monitoring.
Ability to write and modify investigative queries, detections, and correlation logic and analyze identity, endpoint, network, application, and cloud security events.
Practical incident response skills, including scoping, evidence handling, containment, eradication, recovery, root-cause analysis, and corrective action management.
Knowledge of vulnerability management practices, including asset discovery, scanning, validation, risk prioritization, remediation coordination, exception handling, and verification.
Knowledge of enterprise data protection practices, including data discovery, classification, access governance, encryption, monitoring, retention, data loss prevention, and response to suspected misuse or exfiltration.
Experience using scripting, APIs, query languages, and workflow automation to improve security operations, evidence collection, reporting, and tool integration.
Ability to use AI-enabled capabilities responsibly, including human validation, prompt and data handling controls, quality measurement, explainability, and auditability.
Ability to maintain clear operational metrics, runbooks, case records, evidence, and technical documentation suitable for regulated and audited environments.
Strong analytical, troubleshooting, and decision-making skills, including the ability to remain effective during high-severity incidents.
Ability to translate cybersecurity and compliance requirements into practical technical actions and sustainable operating procedures.
Strong collaboration skills across Security, Product, Engineering, Cloud, Compliance, Privacy, Legal, and business teams.
Strong written and verbal communication skills, including explaining technical findings, security risk, and response actions to technical and non-technical stakeholders.
Ability to manage multiple priorities independently, recognize when escalation is required, and deliver reliable outcomes in a fast-paced and evolving cybersecurity environment.
Must be based in the United States.
Must possess or be able to obtain and maintain the personnel screening and access authorization required for CJIS-regulated environments.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent professional experience.

Nice To Haves

Experience supporting a FedRAMP-authorized, CJIS-regulated, or similarly controlled environment.
Experience supporting operational data protection activities.
Experience applying automation or AI-assisted capabilities to security workflows.
Relevant cybersecurity, cloud security, incident response, or security operations certifications.

Responsibilities

Perform day-to-day security operations and security engineering for the designated SaaS product and its supporting AWS environment.
Execute security controls and operating procedures to preserve the confidentiality, integrity, and availability of the product and its data.
Apply FedRAMP, NIST SP 800-53, the CJIS Security Policy, and Granicus security requirements in operational and technical activities.
Complete continuous monitoring, control testing, audit evidence, corrective action, and authorization maintenance activities with relevant teams and system owners.
Identify control gaps, configuration deviations, and emerging technical risks; resolve issues within assigned authority and escalate material concerns.
Operate and maintain endpoint detection and response, centralized security logging and analytics, vulnerability scanning and management, and related cloud security capabilities.
Verify that in-scope assets are inventoried and monitored, telemetry is collected and retained, and agents and sensors remain healthy; correct coverage gaps.
Onboard and maintain security log sources, including parsing, normalization, enrichment, alert routing, retention, access, and data quality.
Execute vulnerability scans, validate findings, prioritize risk, coordinate remediation, track exceptions, and verify corrective actions.
Build and maintain dashboards and operational reporting for asset coverage, control health, vulnerability exposure, alert trends, response performance, compliance posture, and residual risk.
Maintain integrations between security capabilities and cloud, engineering, service management, and collaboration systems.
Monitor security alerts and telemetry, triage events, manage cases, and handle assigned work within established response expectations.
Investigate identity, endpoint, network, application, and cloud activity to determine event scope, impact, root cause, and required action.
Develop, test, and tune detections, correlation logic, and investigative queries relevant to the product environment while reducing false positives.
Perform or support incident response, including scoping, evidence preservation, containment, eradication, recovery, root-cause analysis, and corrective action tracking.
Execute incident response playbooks, escalation paths, notification procedures, exercises, and post-incident reviews appropriate to regulated operations.
Maintain accurate, auditable investigation records, incident timelines, evidence, decisions, and required reports; participate in after-hours response when required.
Coordinate with the Cybersecurity Operations Lead and the other Cybersecurity Operations Engineer to provide monitoring, investigation, and incident response coverage.
Follow and improve runbooks, procedures, quality standards, service metrics, shift handoffs, and escalation practices; maintain cross-training and backup capability.
Escalate complex, high-severity, or time-sensitive issues promptly with technical context, evidence, impact analysis, and recommended actions.
Execute assigned operational activities for the enterprise data protection program and support data discovery, classification, handling, access, encryption, monitoring, retention, and secure disposal controls.
Monitor, triage, and investigate suspected data leakage, misuse, or policy violations in coordination with incident response, Privacy, Legal, and business processes.
Maintain data protection workflows, evidence, metrics, dashboards, exception records, and remediation tracking.
Use approved AI-assisted analysis and automation; validate AI-generated insights and apply human-in-the-loop safeguards for sensitive data.
Use scripting, APIs, query languages, and workflow orchestration to improve security operations, evidence collection, reporting, and integrations.
Propose, test, document, and measure improvements to detections, tooling, workflows, and controls.
Partner with Product, Engineering, Cloud, Compliance, Privacy, Legal, and business teams; provide security input for architecture, changes, releases, remediation, risk decisions, and customer assurance.
Communicate findings, incident status, priorities, tradeoffs, and program performance to technical and non-technical stakeholders.
Support other cybersecurity projects and operational activities as assigned by the Cybersecurity Operations Lead or Senior Director, Global Cyber Defense.

Benefits

Flexible Time Off.
Company-wide paid Wellbeing Days.
Work From Home Reimbursement.
Multiple health plan options, including a 100% employer-paid plan.
Employer HSA contributions when enrolled in a High-Deductible Health Plan.
Fitness Reimbursement Program.
On-demand mental health support, including Headspace and other wellness tools.
Paid parental leave for birthing and non-birthing parents.
Traditional and Roth 401(k) with a generous company match.
100% employer-paid Life and AD&D Insurance.
Online learning platforms for professional development.
Competitive salary and bonuses.
Employee Resource Groups.
Coffee with Mark sessions with the CEO.
Microsoft Teams communities focused on wellness, art, pets, family, and parenting.