Staff IT Security Analyst-Incident Response

Western Governors University•Salt Lake, UT

1d•Onsite

About The Position

This is a lead-level, highly technical security role focused on complex cyber incidents. The Staff IT Security Analyst helps lead incident response, threat detection, investigation, and remediation while shaping the tools, automation, and security capabilities that strengthen WGU’s defenses. The position serves as a hands-on technical leader and escalation point for the IT Security team, partnering with security, infrastructure, engineering, and business teams. The role calls for deep technical expertise, strong investigative instincts, and the ability to turn emerging threats and incidents into improved detections, faster response, and stronger controls. The position is full-time and in-office five days per week at WGU’s Salt Lake City, Utah or Raleigh, North Carolina office. It requires occasional travel of up to 20%, including designated company summits, typically one to two per year, and may include conferences and visits to company locations. WGU does not provide visa sponsorship for this role. The stated salary range is $161,000 to $249,500. This regular full-time position is eligible for bonuses and offers medical, dental, vision, telehealth and mental healthcare; health savings and flexible spending accounts; basic and voluntary life insurance; disability coverage; supplemental accident, critical illness and hospital indemnity coverage; legal and identity theft coverage; a retirement savings plan; a wellbeing program; discounted WGU tuition; flexible paid time off and sick time without accrual; 11 paid holidays; and other paid leaves, including up to 12 weeks of parental leave.

Requirements

Bachelor’s degree in IT Security, Computer Science, Engineering, or a related field; equivalent relevant experience performing the essential functions may substitute for the education requirement at the hiring manager’s discretion.
Seven years of Information Security experience, including understanding of all security domains.
Hands-on experience implementing the MITRE ATT&CK Framework.
Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, or abnormal events.
Hands-on experience maintaining cloud resources using infrastructure-as-code, such as CloudFormation or CDK.
Expertise in a scripting language such as Bash or Python, with strong working knowledge of automation.
Experience with open-source security tools, such as Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, or Eramba.
Hands-on experience with AWS APIs and services including Lambda, DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, and IAM.
Knowledge and experience in cloud and data security, including advanced understanding of core AWS compute, network, storage, database, and identity services.
Hands-on experience integrating security into the various stages of a CI/CD pipeline.
Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions.
Ability to lead in a fast-paced, multidisciplinary environment using a methodical, data-driven approach to security and risk analysis.
Excellent analytical, problem-solving, decision-making, and communication skills, including the ability to turn complex security challenges into practical solutions.
Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA.

Nice To Haves

Relevant security certifications such as CISSP, GIAC, ISACA, or CEH.
15 years of Information Security experience, including understanding of all security domains.
Strong experience with distance education and distance learning students.

Responsibilities

Lead complex incident response and investigations, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identifying opportunities to strengthen defenses.
Lead development of security content and detection use cases aligned with the MITRE ATT&CK Framework; research attacks, identify Indicators of Compromise, analyze large data sets, and develop detection logic for malicious, suspicious, and abnormal activity.
Architect and build cloud threat analytics using log correlation, AI, and machine learning, and develop continuous security and compliance checks across AWS and other cloud platforms.
Design and implement SOAR and security automation to improve security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.
Identify security-model gaps and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
Serve as a technical lead and mentor for analysts, research emerging threats and techniques, develop team capabilities, and provide hands-on guidance during demanding security situations.