Principal, SOC Analyst

WPS—A health solutions company • Fitchburg, WI

5d • $125,000 - $160,000 • Hybrid

About The Position

The Principal, Security Operations Center (SOC) Analyst is the senior technical leader responsible for detecting, investigating, and responding to cyber threats across WPS’s Government and Commercial environments. The role designs threat-informed detections, leads major incident response from initial alert through recovery, and modernizes detection and response capabilities across SIEM, threat hunting, threat intelligence, and security automation. It is part of Cyber Threat Management (CTM), reports to the Manager, CTM, and partners closely with Application Security, Cyber Trust & Architecture, Cyber Risk & Assurance, IT Infrastructure, and IT Application Engineering. The position has no direct reports but includes mentoring SOC analysts and producing metrics and evidence used by leadership to demonstrate operating effectiveness and reductions in cyber risk.

The role architects the SOC monitoring model and detection architecture for two network environments while preserving data isolation and regulatory boundaries. It governs detection content, log-source coverage and quality, and managed service provider performance; leads incident response and related exercises; conducts threat hunting and validates detections; develops automation and AI-assisted workflows; and represents detection and response in audits, assessments, and vendor engagements. U.S. citizenship is required due to Department of Defense restrictions.

The posted salary range is $125,000–$160,000. WPS’s first consideration is for an employee able to use hybrid work and collaboration while living in Wisconsin. Employees within 45 miles of WPS headquarters in Madison are expected to work in the office three days per week. Remote-work requirements include high-speed cable or fiber internet with at least 10 Mbps downstream and 1 Mbps upstream.

Requirements

• U.S. citizenship is required due to Department of Defense restrictions.
• Bachelor’s degree in computer science, cybersecurity, information technology, or a related field, or equivalent education and/or relevant work experience.
• Seven or more years of progressive cybersecurity experience.
• Five or more years in security operations, incident response, and/or detection engineering.
• Extensive experience architecting and governing detection engineering and SIEM operations, including Sentinel/KQL and/or Splunk/SPL, and building, tuning, and measuring detections using the MITRE ATT&CK framework.
• Extensive experience leading incident response using a recognized framework such as NIST 800-61, including complex identity, endpoint, email, and cloud incidents and clear communication during high-impact events.
• Proficient understanding of cloud, identity, and endpoint security telemetry across Azure, Entra ID, Microsoft 365, AWS, and EDR/XDR tools such as Microsoft Defender XDR or CrowdStrike Falcon.
• Proficient security automation skills, including Python or PowerShell scripting, SOAR playbook development, and applying AI to SOC triage and investigation.
• Proficient in applying federal and healthcare security standards, such as NIST 800-53, NIST CSF, CMS ARS, CMMC, and HIPAA, to security operations.
• Strong communication, collaboration, and relationship-management skills.
• Ability to influence without authority and communicate technical concepts to technical and non-technical audiences.
• Strong analytical, organizational, and project-management skills, with the ability to drive initiatives independently.
• For remote work, high-speed cable or fiber internet with at least 10 Mbps downstream and 1 Mbps upstream.

Nice To Haves

• Experience working on federal contracts in a highly security-conscious environment.
• Industry certifications such as CISSP, CCSP, or CISM.

Responsibilities

• Design, build, test, tune, and govern threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external-facing applications.
• Serve as technical lead for SIEM migration detection content and log sources.
• Lead significant security incidents through detection, analysis, containment, eradication, recovery, and post-incident review.
• Maintain and improve incident-response playbooks, including ransomware readiness; support federal and contractual reporting with Legal, Privacy, and Compliance; orchestrate tabletop and recovery exercises; and participate in on-call escalation.
• Define and architect SOC monitoring and detection for both network environments while preserving data isolation and regulatory boundaries.
• Govern log-source coverage and data quality against the enterprise asset inventory, and ensure managed service providers meet service levels for log delivery, alert handling, and containment.
• Conduct hypothesis-driven threat hunts and turn findings into new detections; operationalize threat intelligence to prioritize detections, hunts, and vulnerability response; and validate detection effectiveness through adversary simulation and purple-team exercises.
• Build and maintain automation, orchestration, and AI-assisted workflows to streamline alert triage and investigations.
• Govern and communicate SOC performance metrics, including detection coverage, detection and response times, alert quality, and automation rates, for business reviews and executive risk reporting.
• Mentor and coach SOC analysts.
• Author and govern SOC standard operating procedures, playbooks, and runbooks.
• Represent detection and response in audits, assessments, and vendor engagements, providing evidence of operational effectiveness.
• Partner with other teams to build detection and response requirements into new systems and projects.

Benefits

• Remote and hybrid work options.
• Performance bonus and/or merit increase opportunities.
• 401(k) with a 100% match for the first 3% of salary and a 50% match for the next 2%; immediately vested.
• Competitive paid time off.
• Health insurance, dental insurance, and telehealth services starting on day one.
• Professional and Leadership Development Programs.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior