Principal Security Architect - Cyber Operations and Incident Response

Join the transformative team at City of Hope, where we're changing lives and making a real difference in the fight against cancer, diabetes, and other life-threatening illnesses. City of Hope’s growing national system includes its Los Angeles campus, a network of clinical care locations across Southern California, a new cancer center in Orange County, California, and treatment facilities in Atlanta, Chicago and Phoenix. Our dedicated and compassionate employees are driven by a common mission: To deliver the cures of tomorrow to the people who need them today.

Position Summary:

The Principal Security Architect, Cyber Operations and Incident Response serves as the senior technical authority responsible for the architecture, design, and continuous improvement of enterprise detection, monitoring, threat detection, incident response, and cyber defense capabilities. This role establishes security monitoring strategies, incident response architectures, detection engineering standards, threat intelligence integration, and cyber resilience capabilities that protect clinical, research, business, and technology environments.

The position partners closely with SOC leadership, Incident Response teams, Threat Intelligence, Infrastructure, Identity, Cloud, and Engineering teams to ensure cybersecurity controls generate actionable visibility, effective detection coverage, rapid response capabilities, and measurable risk reduction across enterprise environments.

As a successful candidate, you will:

• Define and maintain enterprise architecture, standards, and roadmaps for SOC operations, SIEM, SOAR, UEBA, threat intelligence, digital forensics, incident response, and cyber defense platforms.

• Lead the design and optimization of enterprise detection engineering programs, security monitoring capabilities, threat hunting frameworks, use-case development, and adversary detection strategies aligned with MITRE ATT&CK and industry best practices.

• Architect and enhance incident response, forensic investigation, cyber resilience, ransomware recovery, and crisis management capabilities across enterprise environments.

• Lead assessment and improvement of security telemetry, log management, detection coverage, alert fidelity, incident workflows, automation opportunities, and response processes.

• Partner with security engineering teams to ensure security technologies generate adequate logging, visibility, and actionable telemetry to support detection and response objectives.

• Provide strategic leadership and technical guidance to SOC analysts, incident responders, threat hunters, detection engineers, and management teams. Develop documentation, standards, executive metrics, and board-level reporting.

• Evaluate emerging threats, adversary techniques, AI-assisted attack methods, security operations technologies, and threat intelligence capabilities to enhance organizational cyber defense effectiveness.

• Follows established City of Hope and department policies, procedures, objectives, performance improvement, attendance, safety, environmental, and infection control guidelines, including adherence to the workplace code of Conduct and Compliance Plan.

• Practices a high level of integrity and honesty in maintaining confidentiality.

• Performs other related duties as assigned or requested.

Your qualifications should include:

Minimum Education:

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Management Information Systems, Computer Information Systems, Computer or Electrical Engineering, or a related field.

OR

• Three additional years of relevant experience may substitute for the minimum education requirement.

Minimum Experience:

• Nine years or more of progressive cybersecurity experience with significant depth in security architecture, security engineering, or both; or a master’s degree and seven years of relevant experience.

• Demonstrated experience designing security controls across complex, multi-vendor enterprise environments and applying risk analysis, risk assessment, and risk management practices

Preferred Education:

• Master’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or another technology-related field

Pref. Certification/Licensure:

• CISSP, GCIH, GCFA, GCIA, GMON, GNFA, GCFE, GRID, SC-200, or equivalent advanced security operations and incident response certifications.

Preferred Experience:

• Leadership of enterprise SOC, incident response, detection engineering, or cyber defense programs.

• Deployment and optimization of SIEM, SOAR, UEBA, NDR, EDR/XDR, and threat intelligence platforms.

• Threat hunting, adversary emulation, digital forensics, and malware analysis programs.

• Cybersecurity operations within healthcare, life sciences, or another highly regulated industry.

• Managed SOC providers, co-sourced security operations, and security service governance.

• Security metrics, detection maturity assessments, and cyber resilience program development.

City of Hope employees pay is based on the following criteria: work experience, qualifications, and work location.

City of Hope is an equal opportunity employer.

To learn more about our Comprehensive Benefits, please CLICK HERE .