Security Orchestration

Security Orchestration Cybersecurity Jobs

4 jobs found

12d ago

Cybersecurity Engineer (SOAR) [JOB ID 20260918]

Phoenix Cyber Arlington, VA

Arlington, VA

12d ago

$70k - $130k/yr Full time Cyber Security Engineer Incident Response

Apply Now

Job Description

Phoenix Cyber is seeking a Cybersecurity Engineer (SOAR) to join a client delivery team on-site at the client location in Arlington, VA. This role centers on building cybersecurity solutions, with a specific focus on security orchestration and incident automation to help strengthen operational security workflows.

The position offers a salary range of USD 70,000 to 130,000 per year and is designed for an engineer with hands-on experience turning security requirements into working automations and integrations.

What you’ll do

Bring technical expertise and real-world experience to create innovative cybersecurity solutions
Develop and implement automations that respond to security incidents
Collaborate with SMEs/engineers, vendors, and project stakeholders to design and develop security orchestrations
Adapt to a fast-paced, ever-changing environment as part of a cross-functional team

What you’ll need

Degree in a STEM-related discipline and/or minimum 5 years of relevant experience
2+ years of experience developing with Python
Working knowledge of Bash and PowerShell
At least 3 years of experience in software development with COTS integration
Working knowledge of one or more languages such as C#, JavaScript, or Node.js
Experience with API development/consumption
Prior consulting experience

Technologies you’ll work with

Python, Bash, PowerShell, C#, JavaScript, Node.js
SOAR
API development/consumption
COTS integration

NICE TO HAVE

Demonstrated proficiency in cybersecurity platforms: SOAR, SIEM, IDS/IPS, DLP, WAF, Endpoint Security
Experience deploying a SOAR tool in an enterprise environment
Experience with SOAR tools including Swimlane, Cyber Triage, Phantom
Experience with container services such as Docker and Kubernetes
Linux administration experience
Cloud infrastructure experience (AWS, Google, or Azure)
Experience with the ELK stack, ECK, Kafka, Beats, and/or Splunk
Experience using Agile methodologies
Prior government or large enterprise experience
Government security clearance

View full job page →

1mo ago

Assistant Director: Cybersecurity

Pima Community College Tucson, AZ

Tucson, AZ

1mo ago Closed

$98k - $113k/yr Full time Manager Cybersecurity Tools Data Loss Prevention

This position is no longer accepting applications (closed Sep 30, 2026).

Job Description

Provide technical leadership and operational direction for an enterprise-wide cybersecurity program supporting institutional data, systems, and digital assets.

Responsibilities

Manage assigned cybersecurity personnel and security operations, including incident response and proactive threat hunting
Provide work direction, technical guidance, mentorship, performance management, and professional development to grow advanced technical capabilities within the team
Oversee and perform advanced cybersecurity administration across network, endpoint, server, and cloud environments
Design, implement, and maintain security controls and defense-in-depth strategies focused on confidentiality, integrity, and availability
Lead and perform complex incident response activities: investigation, containment, isolation, forensic analysis, root cause analysis, recovery, and post-incident review
Coordinate backup and recovery activities associated with cybersecurity incidents
Manage and administer identity and access management and data protection controls, including multi-factor authentication, single sign-on, identity governance, access control frameworks, Data Loss Prevention (DLP), and enterprise email security
Develop and enforce cybersecurity policies, standards, and procedures related to IAM and data protection
Configure, administer, tune, and provide technical oversight of enterprise cybersecurity infrastructure such as firewalls, Security Information and Event Management (SIEM) systems, and security automation and orchestration platforms
Evaluate and advise on the security posture of the College’s technology environment
Lead vulnerability management, attack surface management, and continuous security monitoring activities across institutional environments and externally accessible assets
Identify, assess, prioritize, and mitigate vulnerabilities and cybersecurity risks
Develop, implement, and maintain cybersecurity procedures and technical controls for system hardening, incident response, disaster recovery, security contingency planning, and business continuity cybersecurity components
Serve as a senior technical resource to the CISO and collaborate with IT leadership to align cybersecurity operations and initiatives with institutional goals
Evaluate complex cybersecurity risks and technical issues; develop recommendations and prepare reports to support leadership decision-making
Develop and administer enterprise-wide cybersecurity training and awareness initiatives to reduce human-centered cybersecurity risks
Lead complex cybersecurity projects from requirements definition and design through testing, implementation, documentation, and operational transition
Coordinate project activities and resources; communicate status, risks, issues, and outcomes to appropriate stakeholders
Participate in cybersecurity budget development and resource planning; evaluate security technology and resource needs; support procurement and vendor management; monitor effective use of resources
Perform other duties and responsibilities as assigned or directed by the supervisor

Requirements

Bachelor’s degree in Information Technology or a closely related field of study
Three to five years of related experience
One to three years of supervisory experience
Valid Arizona driver license
An equivalent combination of certification, education, and experience sufficient to perform the essential duties
Master’s degree in Computer Science or a closely related field of study
Five plus years of related experience
Knowledge of business management and fiscal practices
Knowledge of computer and network operating systems
Knowledge of project management principles, processes, and techniques
Knowledge of regulatory compliance principles and practices
Knowledge of server administration, system security, and network design
Skill in budget/resource management
Skill in coordinating and monitoring the work of others
Skill in independent decision making
Skill in people leadership and supervision
Skill in organization, coordination, and management
Skill in problem solving
Skill in program development and process improvement
Skill in team building
Skill in verbal and written communication, including explaining technical concepts to audiences with varying technical skills
Skill in current and applicable hardware, software, and peripheral equipment
Ability to adapt and maintain professional composure in emergent and crisis situations
Ability to develop and maintain effective and positive working relationships
Ability to adapt to a rapidly changing technical environment
Ability to apply analytical and critical thinking to draw conclusions and prepare accurate reports
Ability to work independently and as part of a team environment

Technologies

Multi-factor authentication
Single sign-on
Identity governance
Data Loss Prevention (DLP)
Enterprise email security
Firewalls
Security Information and Event Management (SIEM) systems
Security automation and orchestration platforms
Operating systems

Work Schedule / On-Call / Travel

Flexible work schedule may include evenings and weekends and local travel
On-call rotation duties may be required
Employees are expected to live and work within the state of Arizona as a condition of employment
Selected candidates must successfully complete a background check

Physical Requirements

Environment: Standard office environment with staff contact and frequent interruptions
Physical: Ability to stand or sit for prolonged periods; occasionally stoop, bend, kneel, crouch, reach, and twist; lift/carry/push/pull moderate amounts of weight (up to 50 pounds); operate office equipment requiring repetitive hand movement and fine coordination including use of a computer keyboard; may be required to travel to other locations using various modes of public/private transportation
Vision: Ability to see in the normal visual range with or without correction
Hearing: Ability to hear in the normal audio range with or without correction

Location: Tucson, AZ (onsite)

Compensation: USD 97,600 - 113,450 per year

View full job page →

1mo ago

Senior Security Analyst II

KAMIND IT Lake Oswego, OR

Lake Oswego, OR

1mo ago Closed

$70k - $90k/yr Full time Senior Ai Security Azure

This position is no longer accepting applications (closed Sep 19, 2026).

Job Description

This role is an on-site, senior individual contributor position focused on designing and delivering advanced Microsoft cloud security solutions for KAMIND IT and its clients. The work centers on AI security, DSPM, Microsoft Purview, and expanding Microsoft Sentinel capabilities through integrations.

Role Overview

The Security Analyst Level II designs and delivers advanced Microsoft cloud security solutions as part of KAMIND IT engagements. Primary focus areas include AI & data security architecture, Microsoft Sentinel architecture, and client-facing security architecture and innovation.

AI & Data Security Architecture (Primary Focus Areas)

Design and build AI security solutions for KAMIND and client environments to secure Microsoft 365 Copilot, Azure OpenAI, and other AI workloads, covering identity, data exposure, prompt and response risks, governance, and acceptable-use guardrails.
Design and deliver DSPM (Data Security Posture Management) architectures to discover, classify, and reduce risk across client data estates.
Build Microsoft Purview deployments across its feature set, including Information Protection, Data Loss Prevention, Insider Risk, eDiscovery, Compliance Manager, Communication Compliance, and Records Management.
Design Purview integration with client data lakes including Fabric/OneLake, Azure Data Lake, and third-party sources to extend classification, sensitivity labeling, and governance across structured and unstructured data.

Microsoft Sentinel Architecture

Deploy advanced Microsoft Sentinel solutions, including integration of third-party services (SaaS platforms, network devices, identity providers, EDR/XDR, threat intel, and ITSM) via connectors, Logic Apps, and custom ingestion.
Design KQL analytics, workbooks, SOAR playbooks, and detection strategies aligned to MITRE ATT&CK.
Contribute architectural direction to advanced threat hunting and support post-incident improvements.

Client Architecture & Innovation

Lead security analyst activities on client engagements, including running design workshops, producing architecture artifacts, and guiding implementation teams.
Translate client business requirements, compliance obligations (CMMC, NIST 800-171, ISO, SOC 2, PCI, HIPAA), and risk tolerance into concrete Microsoft security architectures.
Evaluate new Microsoft capabilities and third-party technologies and shape them into repeatable KAMIND service offerings.
Advance CMMC and related compliance architectures for commercial and AOS-G (GCC High) clients.
Prepare executive-level architecture briefings, decision documents, and risk analyses for client and internal stakeholders.
Author technical blogs, reference architectures, KBs, and client-facing collateral that showcase KAMIND thought leadership.
Engage directly with client stakeholders from technical through executive; occasional travel to client sites is expected.
Acquire and maintain relevant Microsoft security certifications.

Required Qualifications

US Citizen due to US DOD/ITAR requirement.
In-person role based in the Lake Oswego, OR office.
5+ years of hands-on IT security experience, including architect-level ownership of Microsoft cloud security designs.
Deep expertise across the Microsoft Defender XDR suite, Microsoft Sentinel, Microsoft Purview, and Microsoft Entra.
Proven experience with CMMC, ITAR, and CUI handling, with strong command of NIST 800-171/800-53.
Hands-on architecture experience with AI security controls, DSPM programs, and Purview data governance at scale, including data lake integration.
Advanced KQL and scripting proficiency (including PowerShell and Python) to prototype detections and automations.
Incident response architecture experience.
Hardening of Azure Virtual Machines using Microsoft security best practices.
Designing and securing Azure Virtual Desktop (AVD) environments.
Network segmentation using VNets, NSGs, Azure Firewall, and Private Endpoints.
Design, deployment, and management of Microsoft Intune solutions, including Windows 10/11 device enrollment and lifecycle management, MDM and MAM, device compliance and configuration policies, and integration with Microsoft Defender for Endpoint.
SC-500 required; plus at least two of: SC-100, SC-200, SC-300, SC-400. AZ-104 is highly desirable.
Bachelor’s degree or higher from an accredited college/university.
Experience producing Information Governance and Security Strategy assessments against CMMC, ISO, NIST, SOC 2, PCI, and HIPAA.
Authorized to work in the US without current or future visa sponsorship.
English language required.
Ability to commute to Lake Oswego, OR 97035 is required.

Technologies

Microsoft 365 Copilot, Azure OpenAI
Microsoft Purview: Information Protection, Data Loss Prevention, Insider Risk, eDiscovery, Compliance Manager, Communication Compliance, Records Management
Fabric/OneLake, Azure Data Lake
Microsoft Sentinel, Logic Apps, KQL, SOAR, MITRE ATT&CK
Microsoft Defender XDR, Microsoft Entra
CMMC, NIST 800-171, NIST 800-53, ISO, SOC 2, PCI, HIPAA, CUI, ITAR
PowerShell, Python
Microsoft Intune, MDM, MAM, Microsoft Defender for Endpoint
SC-500, SC-100, SC-200, SC-300, SC-400, AZ-104
Azure Virtual Machines, Azure Virtual Desktop (AVD), VNets, NSGs, Azure Firewall, Private Endpoints

Compensation and Location

Location: Lake Oswego, OR (onsite), 97035
Salary: USD 70,000 - 90,000 per year

Benefits

Dental insurance
Employee assistance program
Flexible spending account
Health insurance
Paid time off
Professional development assistance
Referral program
Vision insurance

Education and Certification

Education: Bachelor’s (preferred); Bachelor's degree or higher required
Certification: SC-500 required; plus at least two additional Microsoft security certifications from SC-100, SC-200, SC-300, SC-400 (AZ-104 highly desirable)

View full job page →

1mo ago

Staff Security Engineer, Security Operations

ServiceNow Mountain View, CA

Mountain View, CA

1mo ago Closed

Full time Agent Agent Orchestration Agentic Systems

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Move security operations forward with automation. In ServiceNow’s Moveworks Security team, this Staff Agentic Security Engineer role focuses on building autonomous, AI-driven defense capabilities that enhance SOC effectiveness. You will help replace traditional SOAR workflows with resilient, agentic orchestration that improves detection, response, and continuous validation.

Onsite in Mountain View, CA and designed for engineers who want to architect real outcomes: incident response lifecycle automation, proactive threat hunting, and reliable simulation testing that proves agent workflows and detection pipelines trigger against real-world attack behaviors.

What you’ll do

Build advanced AI orchestration: Go beyond basic tool configuration by building, coding, designing, and researching framework-level approaches for chaining MCP servers and AI agents.
Scale proactive threat hunting: Architect and grow a proactive threat hunting program from scratch.
Strengthen Blue Team and AI Red Team collaboration: Create a feedback loop between the Blue Team and ServiceNow’s internally developed AI Red Team Agent.
Partner across engineering and compliance: Work as a strategic engineering partner with IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are “automation-ready.”
Own incident response engineering: Build and maintain an end-to-end incident response roadmap across Detection, Triage, Containment, and Recovery, replacing traditional SOAR workflows with agentic orchestration.
Lead high-stakes escalations: Serve as a top-tier technical escalation point for active, complex incidents.
Validate with automated simulation testing: Design, execute, and validate automated simulation tests to systematically prove agentic workflows and detection pipelines trigger reliably against real-world attack behaviors.

What you bring

U.S. Citizenship required: Must meet strict compliance and FedRAMP criteria.
Experience: 8–10 years in Security Operations, Systems Engineering, or DevSecOps. Minimum 5 years of highly relevant engineering experience required.
Cross-functional mastery: 3–5 years of proven collaboration track record across multidisciplinary teams including Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT.
AI and agentic fluency: Deep familiarity with modern LLM agent frameworks, including active research into application, performance trade-offs, and behavioral guardrails.
Automation engineering: Strong proficiency in Python and software engineering principles.
Cloud and infrastructure depth: Hands-on architectural familiarity with AWS security ecosystems including IAM, CloudTrail, and GuardDuty, plus containerized environments such as Kubernetes and EKS.
FedRAMP and trust awareness: Ability to communicate and translate framework controls into automated, code-driven evidence generation pipelines.
Collaboration mindset: High-autonomy and high-collaboration approach.

Technologies you’ll work with

Python
Model Context Protocol (MCP)
LLM agent frameworks
MCP servers
AWS security ecosystems: IAM, CloudTrail, GuardDuty
Kubernetes, EKS
SOAR

Work persona and office eligibility

ServiceNow assigns work personas (flexible, remote, or required in office) based on the nature of work and assigned work location. To determine eligibility, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.

View full job page →

Security Orchestration Cybersecurity Jobs

Cybersecurity Engineer (SOAR) [JOB ID 20260918]

Assistant Director: Cybersecurity

Senior Security Analyst II

Staff Security Engineer, Security Operations

Get Security Orchestration Cybersecurity Jobs alerts