Staff IT Security Analyst-Incident Response

Western Governors University•Raleigh, NC

1d•$161,000 - $249,500•Onsite

About The Position

This is a lead-level, highly technical security role focused on complex cyber incidents. The analyst leads incident response, threat detection, investigation, and remediation while shaping the tools, automation, and security capabilities that strengthen WGU’s defenses. The role serves as a hands-on technical leader and escalation point for the IT Security team, working with security, infrastructure, engineering, and business partners. It requires deep technical expertise, strong investigative skills, and the ability to turn emerging threats and real-world incidents into better detections, faster response, and stronger controls. The position is full-time and in-office five days per week in WGU’s Salt Lake City, Utah, or Raleigh, North Carolina office. Occasional travel of up to 20% is required, including attendance at designated company summits, typically one to two per year. WGU does not provide visa sponsorship for this role.

Requirements

Bachelor’s degree in IT Security, Computer Science, Engineering, or a related field, or equivalent relevant experience performing the job’s essential functions.
Seven years of Information Security experience, including understanding of all security domains.
Hands-on experience implementing the MITRE ATT&CK Framework.
Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, or abnormal events.
Hands-on experience maintaining cloud resources using infrastructure-as-code, such as CloudFormation or CDK.
Expert scripting experience in languages such as Bash or Python, with strong working knowledge of automation.
Experience with open-source security tools, such as Kali, Nessus, Fortify, AppScan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, or Eramba.
Hands-on experience with AWS APIs, Lambda, DynamoDB, EC2, VPC, CloudFront, CloudTrail, CloudWatch, and IAM.
Knowledge and experience with cloud and data security, including advanced understanding of core AWS compute, network, storage, database, and identity services.
Hands-on experience integrating security into the various stages of a CI/CD pipeline.
Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed-technology security solutions.
Ability to lead in a fast-paced, multidisciplinary environment and use a methodical, data-driven approach to security and risk analysis.
Excellent analytical, problem-solving, decision-making, and communication skills, including the ability to turn complex security challenges into practical solutions.
Understanding of information security regulations, policies, and privacy requirements, including GDPR and CCPA.
The position requires occasional travel of up to 20%, including designated company summits and other business-related travel as needed.

Nice To Haves

Relevant security certifications, such as CISSP, GIAC, ISACA, or CEH.
15 years of Information Security experience, including understanding of all security domains.
Strong experience with distance education and distance learning students.

Responsibilities

Lead complex incident response and investigations, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identifying opportunities to strengthen defenses.
Lead security content and detection use-case development aligned to the MITRE ATT&CK Framework by researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic.
Architect and build cloud threat analytics using log correlation, AI, and machine learning, and develop continuous security and compliance checks across AWS and other cloud platforms.
Design and implement SOAR and security automation to improve security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure-as-code, data security, DLP, encryption, and security tooling.
Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with ServiceNow.
Act as a technical lead and mentor for other analysts, research emerging threats and techniques, develop team capabilities, and provide hands-on guidance during demanding security situations.