Principal Security Architect - Cyber Operations and Incident Response

City of Hope

About The Position

The Principal Security Architect, Cyber Operations and Incident Response serves as the senior technical authority responsible for the architecture, design, and continuous improvement of enterprise detection, monitoring, threat detection, incident response, and cyber defense capabilities. This role establishes security monitoring strategies, incident response architectures, detection engineering standards, threat intelligence integration, and cyber resilience capabilities that protect clinical, research, business, and technology environments. The position partners closely with SOC leadership, Incident Response teams, Threat Intelligence, Infrastructure, Identity, Cloud, and Engineering teams to ensure cybersecurity controls generate actionable visibility, effective detection coverage, rapid response capabilities, and measurable risk reduction across enterprise environments.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Management Information Systems, Computer Information Systems, Computer or Electrical Engineering, or a related field.
OR Three additional years of relevant experience may substitute for the minimum education requirement.
Nine years or more of progressive cybersecurity experience with significant depth in security architecture, security engineering, or both; or a master’s degree and seven years of relevant experience.
Demonstrated experience designing security controls across complex, multi-vendor enterprise environments and applying risk analysis, risk assessment, and risk management practices

Nice To Haves

Master’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or another technology-related field
CISSP, GCIH, GCFA, GCIA, GMON, GNFA, GCFE, GRID, SC-200, or equivalent advanced security operations and incident response certifications.
Leadership of enterprise SOC, incident response, detection engineering, or cyber defense programs.
Deployment and optimization of SIEM, SOAR, UEBA, NDR, EDR/XDR, and threat intelligence platforms.
Threat hunting, adversary emulation, digital forensics, and malware analysis programs.
Cybersecurity operations within healthcare, life sciences, or another highly regulated industry.
Managed SOC providers, co-sourced security operations, and security service governance.
Security metrics, detection maturity assessments, and cyber resilience program development.

Responsibilities

Define and maintain enterprise architecture, standards, and roadmaps for SOC operations, SIEM, SOAR, UEBA, threat intelligence, digital forensics, incident response, and cyber defense platforms.
Lead the design and optimization of enterprise detection engineering programs, security monitoring capabilities, threat hunting frameworks, use-case development, and adversary detection strategies aligned with MITRE ATT&CK and industry best practices.
Architect and enhance incident response, forensic investigation, cyber resilience, ransomware recovery, and crisis management capabilities across enterprise environments.
Lead assessment and improvement of security telemetry, log management, detection coverage, alert fidelity, incident workflows, automation opportunities, and response processes.
Partner with security engineering teams to ensure security technologies generate adequate logging, visibility, and actionable telemetry to support detection and response objectives.
Provide strategic leadership and technical guidance to SOC analysts, incident responders, threat hunters, detection engineers, and management teams. Develop documentation, standards, executive metrics, and board-level reporting.
Evaluate emerging threats, adversary techniques, AI-assisted attack methods, security operations technologies, and threat intelligence capabilities to enhance organizational cyber defense effectiveness.
Follows established City of Hope and department policies, procedures, objectives, performance improvement, attendance, safety, environmental, and infection control guidelines, including adherence to the workplace code of Conduct and Compliance Plan.
Practices a high level of integrity and honesty in maintaining confidentiality.
Performs other related duties as assigned or requested.