Principal Security Operations Engineer

Job Description

Principal Security Operations Engineer

Location: Walnut Creek, CA; Phoenix, AZ; or Honolulu, HI

Employment Type: Full-Time, Direct Hire

Compensation:

Walnut Creek or Honolulu- DOE 160-195k

Phoenix- DOE 150-175k

Note: No C2C or C2H arrangements will be considered. This is a direct contract engagement only. No agencies.

Third-party recruiters, agencies, and vendor representatives: Do not contact personal phone numbers, household members, or any non-business contact associated with StratITech employees or representatives. Any attempt to use personal or household contact information for solicitation, candidate submission, or vendor outreach is strictly prohibited and will be reported to LinkedIn.

About the Role

We are seeking a Principal Security Operations Engineer to serve as a senior technical leader for cybersecurity incident response, security operations, and infrastructure-level investigation across a complex, distributed enterprise environment.

This is not a traditional SOC analyst role or a people-management position. The right candidate will take ownership of high-severity cybersecurity incidents while going deep technically across firewalls, DNS, Active Directory, endpoint telemetry, cloud logs, SIEM/logging pipelines, and network security infrastructure.

Working closely with the Senior Manager, this individual will provide technical leadership, mentorship, and guidance to the team while maintaining hands-on responsibility for complex investigations and incident response activities.

The organization uses external monitoring and managed detection support for initial alerting. Escalated events require an experienced technical leader who can validate the signal, determine scope, coordinate containment, guide technical teams, communicate risk to leadership, and drive incidents through remediation, root-cause analysis, and post-incident improvement.

What You'll Do

\n
• Own incident response for high-severity cybersecurity incidents, serving as Incident Commander from initial triage through containment, remediation, recovery, root-cause analysis, and post-incident review.
\n
• Validate escalations from managed detection providers and determine whether suspicious activity represents true compromise, false positive, misconfiguration, or business-approved behavior.
\n
• Investigate incidents across firewall logs, DNS logs, endpoint telemetry, Active Directory events, cloud audit logs, SIEM data, vulnerability data, and third-party security alerts.
\n
• Lead infrastructure-level security investigations involving TCP/IP traffic, firewall state tables, NAT, ephemeral ports, DNS forwarding, suspicious authentication, anomalous cloud activity, endpoint compromise, and Active Directory risk.
\n
• Partner with the Senior Manager and infrastructure, network, endpoint, cloud, and application teams to determine scope, implement containment, confirm root cause, and verify remediation.
\n
• Serve as a senior technical resource and mentor , providing guidance, knowledge sharing, and technical direction to colleagues during complex investigations and security incidents.
\n
• Drive improvements to incident response processes, escalation paths, runbooks, tabletop exercises, communication templates, and post-incident review practices.
\n
• Help improve asset visibility by correlating data from Active Directory, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB sources, and network telemetry.
\n
• Communicate clearly with technical teams, executives, legal/compliance stakeholders, and external partners during active incidents.
\n

Required Experience

\n
• Senior-level experience in cybersecurity incident response, security operations, cyber defense, or principal-level security engineering.
\n
• Demonstrated experience serving as an Incident Commander, Incident Response Lead, SOC escalation leader, or senior incident owner for high-severity cybersecurity incidents.
\n
• Proven ability to personally own and drive incidents from initial triage through containment, remediation, root-cause analysis, post-incident review, and operational improvement.
\n
• Strong understanding of TCP/IP fundamentals, including source/destination ports, ephemeral ports, NAT, firewall state tables, and stateful inspection.
\n
• Ability to interpret firewall logs, connection logs, NAT behavior, blocked/allowed traffic, and network security events during an investigation.
\n
• Experience investigating DNS-based threats, including DGA alerts, suspicious domain activity, DNS forwarding, passive DNS, DNS server logs, and identifying the originating host behind suspicious DNS requests.
\n
• Strong understanding of Active Directory security and compromise response, including administrator workstation compromise, credential exposure, lateral movement risk, Tier 0 assets, and domain controller investigation.
\n
• Experience with SIEM/logging architecture and troubleshooting, ideally Splunk or a comparable platform.
\n
• Understanding of syslog limitations and log transport challenges, including UDP syslog, packet loss, TCP syslog, buffering, spooling, and store-and-forward logging designs.
\n
• Experience validating asset inventory and exposure using sources such as AD, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB records, and network telemetry.
\n
• Ability to provide technical leadership, collaborate across teams, and mentor colleagues without formal people-management responsibilities.
\n
• Strong communication skills with the ability to brief executives, coordinate technical teams, and communicate business risk during active security incidents.
\n

These Skills Are a Plus

\n
• Experience in transportation, logistics, maritime, shipping, industrial, critical infrastructure, or other distributed operational environments.
\n
• Experience supporting remote offices, branch networks, ships, satellite links, or high-latency / low-reliability network environments.
\n
• Experience with Splunk architecture, including Universal Forwarders, indexers, search heads, CIM normalization, indexer acknowledgment, queue troubleshooting, and Splunk internal logs.
\n
• Experience with Palo Alto, Fortinet, Check Point, Cisco, or similar firewall and network security platforms.
\n
• Experience with Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, or other EDR/XDR platforms.
\n
• Digital forensics experience across endpoint, network, cloud, identity, or email investigations.
\n
• Experience with ransomware, business email compromise, credential theft, Mimikatz, lateral movement, suspicious authentication, cloud account compromise, or third-party compromise scenarios.
\n
• Experience working with MDR/MSSP providers such as ReliaQuest or similar managed detection partners.
\n

What Success Looks Like

The right person can take a vague or incomplete security signal, determine whether it matters, identify what data is missing, pull in the right teams, make containment recommendations, communicate clearly, and drive the incident to closure.

Success requires calm incident leadership, hands-on technical credibility, and a genuine commitment to remaining engaged in complex security engineering work.

This individual will be a trusted technical partner to the Senior Manager, providing mentorship and guidance to colleagues while taking direct ownership of critical security incidents.

The focus is on technical expertise, accountability, collaboration, and continuous improvement—not formal people management.