Security Information And Event Management

Security Information And Event Management Cybersecurity Jobs

181 jobs found

Today

Senior Cybersecurity Engineer

Vertage United States

United States

Today

$50 - $55/hr Full time Senior Application Security Cloud Platforms

Apply Now

Job Description

The BISO Engineer is an embedded cybersecurity practitioner aligned to an assigned business unit, responsible for translating enterprise security direction into practical controls and programs across enterprise and operational technology environments.

Role Summary

In this position, you act as a bridge between overall enterprise security strategy and operational execution. The work focuses on identifying risk, driving remediation, and converting security requirements into actionable unit-level initiatives. You will coordinate with multiple security platforms and stakeholders to maintain an effective security posture across applications, infrastructure, and OT.

Responsibilities

Serve as the primary cybersecurity liaison for assigned business unit(s), converting enterprise security policies into unit-specific controls and procedures
Conduct and support risk assessments, vulnerability management reviews, and security posture evaluations across applications, infrastructure, and OT environments
Lead or support security initiatives covering WAF/firewall configurations, identity and access management reviews, endpoint protection, and cloud security posture
Represent the business unit in change management and security governance forums
Coordinate with enterprise SIEM, network security, and application security platforms to ensure appropriate monitoring and enforcement
Support M&A integration activities, including network segmentation, firewall onboarding, and security baseline validation
Develop and maintain security documentation such as policies, runbooks, risk acceptance memos, and remediation plans
Engage stakeholders across technical and leadership groups, and present risk posture and program status to senior management

Required Qualifications

5+ years of experience in cybersecurity engineering, architecture, or risk management
Hands-on experience with WAF, NGFW, SIEM, or vulnerability management platforms
Strong understanding of NIST CSF, CMMC, or equivalent frameworks
Proven ability to manage cross-functional security programs with minimal oversight

Preferred Skills

Experience in energy, utilities, or OT/ICS environments
Familiarity with relevant cloud WAF, segmentation, SIEM, or firewall management tools
CISSP, CISM, or equivalent certification
Experience supporting M&A cybersecurity integration

Technology and Framework Focus

WAF, NGFW, SIEM, vulnerability management platforms
NIST CSF, CMMC
Security posture evaluations, identity and access management
Endpoint protection, cloud security posture
Network segmentation, firewall onboarding
Enterprise SIEM, network security, application security platforms

Location and Work Setting

United States, onsite. The position requires physical office presence.

Engagement Dates and Compensation

Start and end date: 05 Oct 2026 – 05 Oct 2027
Indicative hourly rate: $50 – $55 per hour
Respond by: 01 Oct 2026

Additional Information

Languages: English (professional working proficiency)
Skill areas (intermediate): security engineering, security requirements, security information and event management, vulnerability management, network security, network segmentation, merger and acquisitions, and software security

View full job page →

Today

IT Security Analyst

BorgWarner Auburn Hills, MI

Auburn Hills, MI

Today

$62k - $85k/yr Full time Ai Security Analytics Cyber Security

Apply Now

Job Description

BorgWarner is seeking an IT Security Analyst to join its Security Operations team in Auburn Hills, MI. This onsite role supports global cybersecurity operations by improving how the organization detects, analyzes, and responds to threats across enterprise systems and data. You will help build and optimize security tooling, automate investigation workflows, and strengthen detection and response capabilities using modern security operations platforms.

What you’ll do

Respond to, remediate, and coordinate incident response actions with internal and external stakeholders on a day-to-day basis
Monitor security alerts and logs from SIEM and other security alerting tools
Create searches and reports to prevent disruption or unavailability of information assets and to assess impact
Analyze security attacks and decide or advise on solutions, including configuring new security tools
Use AI-powered security operations platforms to investigate, correlate, and triage security events
Develop, validate, and optimize AI-assisted detection and response workflows
Evaluate AI-generated findings and ensure accuracy through analyst verification
Partner with engineering teams to automate investigation and response processes using agentic workflows
Develop and maintain technical runbooks and process documents
Perform in-depth analysis of suspicious activity and attempted attacks during and after incidents, including malware, packets, alerts, and logs
Monitor and investigate security events across cloud platforms and SaaS applications
Investigate identity-based attacks, account compromise, MFA bypass attempts, and privilege escalation events
Stay current with incident response technology, methodology, and legal requirements
Develop scripts and automation to streamline security operations tasks
Ensure investigations follow regulatory requirements and internal corporate policies, standards, and procedures
Provide metrics and periodic intelligence reports, including lessons learned on threat actors and IOCs
Continuously improve relevant intelligence sources and methods, recommending new tools and procedures to detect threats and protect intellectual property and assets
Maintain and optimize security tools including endpoint protection, EDR, DLP, and Email Security
Support formal investigations and/or inquiries related to insider threat matters and acceptable use policy violations
Identify internal process improvement opportunities and possible solutions
Work with the Security Operations Lead to define and document standard operating procedures for security incident handling, malware analysis, and vulnerability management
Maintain confidentiality related to professional secrets and the security of documents handled and administered

What you bring

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field
2+ years of experience in IT Security with a focus on Incident Response and security operations
Strong understanding of security principles, threat landscapes, and incident response
Experience with SIEM, EDR, DLP, VM, Email Security, and Threat Intelligence platforms
Relevant certifications are preferred (examples: Sec+, GSEC, GCIA, CEH, CISSP)
Fluent English in written and verbal communication
Deep understanding of security systems, firewalls, authentication systems, log management, content filtering, and network security/networking technologies
Experience working with and managing at least one of: SIEM, EDR, DLP, VM, Email Security
Proven knowledge across advanced threats, information security incident detection and response, and forensic investigative practices
Experience developing, collecting, and analyzing threat intelligence
Experience in AI and autonomous response
Experience with cyber intelligence analytic methodologies including Kill Chain, threat modelling, and threat hunting
Relevant experience in an international environment
Ability to identify problems, recognize significant threats and risks, and connect data to trace possible causes
Ability to investigate relevant data and uphold generally accepted social and ethical standards in job-related activities
Strong written, oral, and presentation skills

Technologies you’ll work with

SIEM, EDR, DLP, VM, Email Security
Threat Intelligence platforms
AI-powered security operations platforms
Agentic workflows
Kill Chain, threat modelling, threat hunting

Location and salary

Onsite role based at World Headquarters in Auburn Hills, MI, USA.

Salary: USD $62,000 - $85,250 per year.

View full job page →

Today

Information Security Analyst III

SchoolsFirst FCU Tustin, CA

Tustin, CA

Today

$53 - $86/hr Full time Cyber Security Cybersecurity Tools Information Security

Apply Now

Job Description

The Information Security Analyst III is responsible for day-to-day monitoring and operational procedures that help safeguard information systems assets. This role supports confidentiality, availability, and integrity through security reviews, documentation, policy and process assistance, and direct engagement with users to implement appropriate security measures.

Onsite Location

Tustin, CA (onsite)

Compensation

USD 53 - 86 per hourly

Key Responsibilities

Perform procedures that protect information systems assets and defend against intentional or inadvertent access or destruction.
Support security awareness by ensuring team members understand and follow required procedures.
Carry out daily operations and monitor events across multiple sources, including SIEM consoles, network and host-based intrusion detection systems, firewall consoles, Unix and Windows system logs, applications, databases, and other security monitoring tools.
Participate in knowledge sharing with other analysts and contribute technical articles to the internal Knowledgebase.
Create, maintain, and update documentation for procedures and process improvement.
Interface with users to identify security needs and implement procedures that align with security and business initiatives.
Evaluate the level of security required when requests come from other team members, ensuring appropriate measures are in place to protect confidentiality, availability, and integrity.
Assess business needs alongside security concerns, recommend solutions that support business objectives, and communicate issues to management.
Assist with the development, implementation, and periodic review of security policies, procedures, and metrics to support industry best practices and standards.
Conduct security assessments and reviews of local area networking initiatives for security compliance.
Ensure that system resource configurations, software, applications, processes, or guidelines comply with Information Security requirements, policies, and standards.
Assist in planning, organizing, and implementing Information Security-related projects.
Perform other duties as assigned.

Required Qualifications

High School Diploma or GED required
Bachelor’s Degree in a related field or equivalent years of experience required
5-7 years of prior relevant experience required

Preferred Qualifications

CISSP, SANS GIAC, or equivalent

Relevant Skills and Knowledge

Familiarity with domain structures, user authentication, and digital signatures may be required.
Ability to accurately evaluate the appropriate level of security for requested activities.
Understanding of firewall theory and other security system configurations.
In-depth knowledge of intrusion detection and Internet architecture.
Capability to weigh business needs against security concerns and articulate issues to management.

Tools and Technologies

SIEM consoles
Network intrusion detection systems
Host based intrusion detection systems
Firewall consoles
System logs (Unix and Windows)
Applications
Databases
Knowledgebase

Compliance and Training

The position requires compliance with regulatory requirements and assigned training requirements, including BSA regulations corresponding to specific job duties. Failure to comply may lead to disciplinary and other employment-related actions.

View full job page →

Today

Security Analyst

Rover.com Seattle, WA

Seattle, WA

Today

$118k - $148k/yr Full time Ai Security Analytics Aws Cloud Security

Apply Now

Job Description

Rover.com is hiring a Security Analyst to strengthen vulnerability management and support security operations across corporate SaaS systems and AWS-hosted cloud applications. This hybrid role focuses on using practical monitoring and investigation, building out Splunk detections and reporting, and applying AI and automation to reduce manual effort and improve compliance readiness. The position also includes opportunities to collaborate across teams, evaluate existing security processes, and help raise security awareness across the organization.

Location: Seattle, WA (hybrid)
Schedule: Minimum expectation to work out of our Downtown Seattle Office two days per week on Mondays and Thursdays
Note: Candidates must be based in the Greater Seattle Area or willing to relocate.

What you’ll do

Own and mature Rover’s vulnerability management program, including identifying, prioritizing, tracking, and driving remediation across corporate SaaS systems and AWS-hosted cloud applications
Support day-to-day security operations through monitoring, triage, and investigation of security alerts and incidents
Build and refine Splunk searches, dashboards, and alerts to improve the speed, accuracy, and efficiency of security monitoring and investigations
Identify and implement opportunities to use AI and automation to increase efficiency across security operations, vulnerability management, and compliance reporting
Work cross-functionally to prepare documentation and evidence for audits and regulatory frameworks including SOX, PCI, GDPR, and CCPA
Evaluate existing security plans, processes, and procedures, then propose enhancements
Develop analyses and reports on historical and potential security incidents, including root cause and business impact
Research emerging security trends and technologies to keep defenses current
Make recommendations to managers and senior leaders to strengthen protection for company systems
Promote security awareness and best practices among Roverines to support company-wide security culture

What you bring

BS in computer science, information systems, information security, or a related field (or equivalent work experience)
3+ years in information security, security operations, or vulnerability management, ideally with exposure to cloud computing and web applications
Demonstrated experience working with AWS or other cloud platform technologies
Experience with Splunk or similar SIEM and log analysis tooling
Strong communication skills with a track record of collaboration and teamwork
Demonstrated understanding of and experience with security-related technologies, systems, and tools

Bonus skills

Proficiency with Python, Django, SQL, JavaScript, or mobile application development
Experience building Splunk searches, dashboards, or detections at scale
Practical experience applying AI or automation to streamline security operations, vulnerability management, or reporting workflows
Experience with threat modeling, vulnerability assessment, and scoring systems (for example, CVSS)
Practical experience with IAM role and policy development and evaluating their efficacy
Security certifications such as CompTIA Security+, CEH, CISA, CGEIT, CRISC, and others

Compensation

For the greater Seattle area, the first-year salary range is $118,476 to $148,095 per year. Cash compensation for this role will depend on the candidate’s experience, qualifications, skills, and abilities demonstrated during the interview and hiring process. Rover also offers benefits to full-time employees.

Tools and technologies

Splunk, AWS, Python, Django, SQL, JavaScript

View full job page →

Today

Senior Cyber Security Engineer

CACI Colorado Springs, CO

Colorado Springs, CO

Today

$90k - $190k/yr Full time Senior Cis Benchmark Cyber Security

Apply Now

Job Description

The Senior Cyber Security Engineer will design, test, and implement secure operating systems, networks, and database products while leading RMF risk assessments and cybersecurity initiatives. The role also supports IA and cybersecurity processes, validations in eMASS, and integrated security system engineering.

Key Responsibilities

Maintain multiple RMF packages and perform risk assessments across mission systems supporting the Data Transport and Receive Network (DTRN) (including SCN, SCN Test Lab, and Orbital Analysis Subsystem).
Lead and task Junior and Journeymen Information Security Analyst to execute RMF activities effectively.
Develop and implement an Anti-virus/Malware identification process to support equipment check-in and check-out activities for SCN equipment between SCN sites.
Coordinate with the SWMA IA patching team and the program office IA architecture team to define an IA/Cybersecurity Roadmap, identifying non-compliant IA controls and proposing corrective actions.
Work with the Government to apply system security engineering to design, develop, and implement secure applications and configurations.
For IA-impacting mission hardware acquisition efforts, evaluate available COTS and GOTS hardware, firmware, and software information security components.
Organize annual cybersecurity control validation in eMASS in accordance with DoDI 8510.01 and DoDI 8500.01.
Attend Technical Interchange Meetings at key project phases (for example, Requirements and Design) to obtain cybersecurity community approvals.
Contribute to information security, privacy, and incident response policies, procedures, and standards, and monitor compliance with those programs.
Provide technical engineering services management for support of integrated security systems and solutions.
Use tools and processes to monitor information systems for security-related events.
Assess cybersecurity configuration changes for major security infrastructure platforms.
Help maintain a library of security audit tools and corresponding processes for system security testing, internal audits, incident response, and diagnosis of security-related system issues.
Travel to CONUS and OCONUS locations may be required (up to 20%).

Required Qualifications

BS Degree in a related field plus 5 years of related experience, or an equivalent combination of education and experience.
Active DoD Secret Security Clearance required, or ability to obtain and maintain one.
Technically competent with strong data analysis, critical thinking, decision making, and customer focus.
Self-motivated with a desire to learn, strong professional interpersonal skills, pride in work, and strong teamwork.

Technologies and Tools

RMF, eMASS
DoDI 8510.01, DoDI 8500.01
SCN, SCN Test Lab, Orbital Analysis Subsystem
SWMA
COTS, GOTS
ACAS, ESS, SIEM, STIGs
CISSO
CySA+, GPEN, CISA

Desired Qualifications

DoD 8140 Cyber Defense Analyst or Vulnerability Analyst Intermediate Qualification or certification (for example, CISSO, CySA+, GPEN, CISA, or a technical BS from an ABET accredited or CAE designated institution as defined in DoD 8140).
SCN and/or DoD experience.
Cybersecurity tool experience, such as eMASS, ACAS, ESS, SIEM, STIGs.
Flexibility and willingness to take on unanticipated tasks.

Compensation, Location, and Work Details

Location: Colorado Springs, CO (onsite)
Salary Range: USD 90,300 to 189,600 per year
Time Type: Full time
Employee Type: Regular
Job Category: Information Technology
Travel: Up to 10% (with additional travel to CONUS/OCONUS locations may be required up to 20%)
Type of Travel: Continental US
Anticipated Posting End: 12/31/2026

Benefits

Healthcare and wellness
Financial and retirement
Family support
Continuing education
Time off benefits
Robust learning resources

Additional Opportunity Details

Designs, tests, and implements state-of-the-art secure operating systems, networks, and database products.
Leads risk assessments and provides application design recommendations.
Leads cybersecurity initiatives including architectures, firewalls, electronic data traffic, and network access.
Provides guidance on encryption technology and supports penetration and vulnerability analysis of security technologies, along with information technology security research.
May support security report preparation for delivery to regulatory agencies.

What You Can Expect

A culture of integrity
An environment of trust
A focus on continuous growth

View full job page →

Today

Cloud Security Engineer

Tulip Interfaces Boston, MA

Boston, MA

Today

$110k - $150k/yr Full time Application Security Cloud Security Cloud Security Posture Management

Apply Now

Job Description

Tulip Interfaces is a security-focused team building cloud protections that directly shape product and culture. This hybrid role in Boston, MA offers company equity and a benefits package designed to support your health, family, and long-term growth, including health, dental, and vision coverage, flexible spending, parental leave, a 401(K), flexible work scheduling, and an unlimited vacation policy. You will help strengthen security engineering across cloud security, detection and alerting, vulnerability management, and compliance support, with hands-on work primarily in AWS.

What you’ll do

Design, build, and maintain security controls as code across cloud environments, including posture hardening and account-level guardrails.
Own vulnerability management end-to-end: triage findings across environments, prioritize to reduce noise, and drive remediation through to closure.
Run the recurring alert-review workflow, tuning detections, reducing false positives, and improving coverage over time.
Build and maintain log ingestion and SIEM pipelines, and participate in incident response work.
Partner with engineering and product teams on architecture, authentication, and application security reviews, including code review and automated testing.
Support FedRAMP and other compliance efforts through documentation upkeep, alert monitoring, evidence collection, training exercises, and customer security questionnaires.

What you bring

5+ years of security engineering experience with hands-on ownership of cloud security work.
Deep, hands-on experience securing AWS and/or Azure environments, including containerized and Kubernetes workloads (EKS/AKS).
Ability to build and manage security controls as code using Terraform and Python (or similar).
Experience authoring and tuning detections and SIEM rules, and running vulnerability and container-image scanning in CI.
Working knowledge of compliance frameworks such as FedRAMP, ISO 27001, or SOC 2, including evidence practices.
Nice to have: incident response or forensics experience, threat modeling of new services, or running internal security exercises.
Education: Bachelor's degree in a technical field, or equivalent working experience.

Tools you’ll work with

AWS, Azure, EKS, AKS, Terraform, Lambda, Python, Kubernetes, SIEM, FedRAMP, ISO 27001, SOC 2

Collaboration

Infrastructure and Product Engineering
IT, Legal & Compliance, and Product Management
Engineering and Security leadership

Benefits

Company equity
Health, Dental, Vision
Short-term Disability
Long-term Disability
Life Insurance, AD&D Insurance
Flexible Spending Account (FSA)
Commuter Benefits
Parental Leave
401(K)
Flexible work schedule
Unlimited vacation policy
Learning & Development program
Virtual company events and happy hours
Fitness subsidies
Inclusive, dog-friendly office
Direct impact on product and culture

View full job page →

Today

Sr IT Security Engineer

American Medical Association Chicago, IL 🇺🇸 Remote

Chicago, IL

Today

$116k - $151k/yr Full time Application Security Cisa Cism

Apply Now

Job Description

Remote Sr IT Security Engineer role with AMA’s Infrastructure Ops team focused on cyber threat intelligence, security platforms, and day-to-day security operations.

Responsibilities

Research, design, and advocate new security technologies, architectures, and products to support enterprise and customer/vendor security requirements
Plan, document, and execute enterprise-wide security programs, including vulnerability identification and testing and a network scanning framework for public and private networks
Configure and troubleshoot vulnerability assessment tools and endpoint solutions; run scans and research threats; summarize findings and corrective actions as appropriate
Partner with IT, compliance, audit, and others to ensure application and infrastructure development, implementation, and administration meet IT security and regulatory audit compliance standards
Communicate IT Security policies and procedures to management and end users across businesses
Collect and analyze defined security metrics, including security dashboards and training results, for leadership reporting
Develop and deliver information security awareness training, including phishing simulations and risk-based training content for high-risk users
Identify, collect, and organize credible intelligence and subject matter relevant to current and emerging threats using available tools, applications, and open-source information
Define and document application security standards for developers and ensure compliance with applicable security controls when those standards are used
Design, lead, and project manage development and configuration of security tools and automation based on specific use cases
Proactively monitor, analyze, block, and respond to malware and emerging threats; act as technical point of contact during and after security incidents, including digital forensics procedures
Conduct operational threat hunting exercises to proactively find incidents within the AMA environment
Perform threat modeling and risk assessments using standard security frameworks for cloud services
Monitor and audit on-premise and cloud networks and systems, including service changes
Document incident response procedures and support management communications during incidents
Assist in managing security services providers
Research new threats, attacks, and risks to infrastructure and software
Define and document operating procedures for incident identification, investigation, and response
Work with business teams to identify and address data security risks in business processes
Analyze and recommend actions to improve security posture across cloud and hybrid environments and related services/configurations
Improve security reporting by coordinating vulnerability management, penetration testing, and infrastructure compliance
Create or update detailed operational processes and procedures covering security operations, incident management, and code development

Requirements

Bachelor’s degree in Information Security, Engineering, Computer Science, or related field
Demonstrated progression toward one or more security certifications: GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), CISSP/CISA, or CISM
5+ years of Security Operations experience, including cyber incident investigations
Strong understanding of network and host-based security applications and tools
Exposure to enterprise web application programming and Application Security (AppSec)
Knowledge of browser security controls, web application security frameworks, and authentication infrastructures (SAML, OAUTH)
Knowledge of technical infrastructure, endpoints, networks, databases, and systems as related to IT security and IT risk
Understanding of cloud networking concepts and architecture to promote and develop cloud security designs and strategies (IaaS, PaaS, SaaS)
Excellent written and verbal communication skills, including communicating technical concepts to business leaders and users clearly and with appropriate urgency/priority
Ability to respond to security incidents promptly and independently under time pressure
Excellent analytical, organizational, and communication skills; demonstrated ability to facilitate cross-functional teams
Experience with continuous improvements and agile methodology

Technologies

firewalls
SIEM
data loss prevention
web application firewalls
application security testing
VPN
SAML
OAUTH
GIAC Certified Incident Handler (GCIH)
GIAC Certified Intrusion Analyst (GCIA)
CISSP
CISA
CISM
CISSP/CISA

San Francisco, CA

1d ago

$130k - $165k/yr Full time Senior Ai Security Analytics

1d ago

On-Site Information Security Analyst

3d ago

$72k - $108k/yr Full time Cyber Security Cybersecurity Analysis Cybersecurity Tools

Security Information And Event Management Cybersecurity Jobs

Get Security Information And Event Management Cybersecurity Jobs alerts