Position Summary:We are seeking an experienced Principal Security Operations Lead to join the North America Information Security team, reporting directly to the Director of Security Operations. This is a hands-on technical role focused on incident response, threat intelligence, and forensic investigations across cloud and legacy environments.
The successful candidate will help support a unified enterprise security operations model, including the continued implementation of SIEM and detection tools across environments, advanced threat intelligence, and automated response processes. The role requires strong Microsoft Azure and Microsoft 365 security experience, multi-layer investigations, phishing response, clear communication, and the ability to work across Security Engineering, Security Operations, GRC, Infrastructure, Cloud, DevOps, application, and business teams.
This role is expected to act as the key contact for technical investigations, drive remediation, produce clear documentation and evidence, and provide quality review and escalation support for repeatable work performed by offshore or managed-service partners.
What You Will Do:Threat Intelligence and Adversary Analysis- Lead the collection, analysis, and operationalization of cyber threat intelligence from internal telemetry, commercial intelligence providers, open-source intelligence (OSINT), and industry sharing groups.
- Analyze adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK and translate intelligence into actionable detections, monitoring requirements, investigations, and security control improvements.
- Develop intelligence reports, threat briefs, and executive summaries that communicate emerging threats, risk trends, adversary activity, and potential business impacts.
- Track industry-specific threats affecting insurance, financial services, healthcare, cloud platforms, and software supply chains.
- Partner with Security Engineering and Security Architecture teams to incorporate threat intelligence into detection logic, control design, policy updates, and incident response processes.
Security Monitoring and Incident Investigation- Lead advanced investigations involving suspicious activity, account compromise, insider threats, ransomware, malware infections, cloud attacks, phishing campaigns, business email compromise, data exfiltration, and unauthorized access attempts.
- Perform deep analysis of security alerts generated by SIEM, XDR, EDR, email security, identity platforms, cloud security
- solutions, and network security tools.
- Correlate logs, events, endpoint telemetry, cloud activity, authentication records, and threat intelligence to determine attack
- scope, impact, and root cause.
- Serve as an escalation point for complex investigations requiring advanced analytical skills, cross platform analysis, or forensic validation.
Digital Forensics and Evidence Preservation- Conduct forensic investigations involving endpoints, servers, Microsoft 365, Azure, identity platforms, email systems, cloud workloads, and hybrid environments.
- Acquire, preserve, analyze, and document digital evidence while maintaining chain-of custody requirements and evidentiary integrity.
- Perform memory analysis, artifact collection, timeline reconstruction, log validation, malware triage, and root-cause investigations.
- Develop forensic findings reports that clearly document attack timelines, affected assets, responsible threat activity, business impact, and recommended remediation actions.
- Support legal, compliance, audit, and regulatory response activities requiring technical investigative evidence and forensic documentation.
Threat Hunting and Detection Engineering- Design and execute proactive threat-hunting activities to identify malicious activity that may evade traditional detection methods.
- Hypothesis driven hunting across Azure, Microsoft 365, Sentinel, Microsoft XDR, Defender for Endpoint, Entra ID, network telemetry, and cloud application logs.
- Develop and improve advanced detection logic, correlation rules, behavioral analytics, watchlists, and hunting queries based onemerging threats and intelligence findings.
- Identify detection gaps and recommend new monitoring capabilities to improve visibility across cloud, endpoint, identity, and network environments.
Incident Response and Cyber Crisis Support- Serve as a lead technical responder during cybersecurity incidents, coordinating containment, eradication, recovery, and post-incident analysis activities.
- Guide incident response efforts during ransomware events, credential compromise investigations, data breaches, insider threat cases, cloud security incidents, and advanced persistent threat (APT) activity.
- Facilitate technical war rooms and provide timely status updates to leadership, technology teams, legal stakeholders, and
- Ensure incidents are documented thoroughly with clear investigative findings, response actions, lessons learned, and
- remediation recommendations.
- Participate in incident response exercises, tabletop simulations, and cyber resilience testing to improve organizational
Security Operations Platform Optimization- Support and continuously improve Microsoft Sentinel, Microsoft XDR, Defender for Endpoint, Defender for Cloud, Entra ID,
- Crowdstrike, and related detection and investigation technologies.
- Create dashboards, automated workflows, enrichment processes, and case management integrations that improve investigation speed and analyst effectiveness.
- Tune detections, reduce false positives, standardize triage processes, and help mature security operations capabilities across
- Develop metrics and reporting that measure detection performance, investigation quality, containment effectiveness, Mean Time to Acknowledge (MTTA), and Mean Time to Respond (MTTR).
Senior Technical Expertise and Security Operations Maturity- Act as a senior analyst and subject matter expert for threat intelligence, forensic investigations, incident response, and threat hunting activities.
- Provide quality review, mentoring, and escalation support for analysts, offshore resources, managed security service providers, and security operations partners.
- Develop investigation playbooks, forensic procedures, threat-hunting methodologies, standard operating procedures, and analyst training materials.
- Maintain professional documentation including incident reports, forensic reports, threat profiles, attack-path analysis, runbooks, diagrams, and executive briefings.
- Stay current on emerging threats, attack techniques, cloud security risks, adversary campaigns, and cybersecurity best practices to continuously strengthen organizational defense capabilities.
What You Will Bring:
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Digital Forensics, Information Assurance, or a related discipline; equivalent professional experience may be considered.
- Minimum 10 years of progressive experience in Security Operations, Threat Intelligence, Incident Response, Threat Hunting, Digital Forensics, or Cyber Defense roles within enterprise environments.
- Demonstrated experience conducting complex investigations involving ransomware, business email compromise (BEC), insider threats, account compromise, malware infections, cloud security incidents, advanced persistent threats (APT), and data exfiltration events.
- Advanced knowledge of cyber threat intelligence methodologies, including the collection, enrichment, analysis, and operationalization of intelligence from commercial providers, industry sharing groups, open-source intelligence (OSINT), and internal telemetry sources.
- Strong understanding of adversary tactics, techniques, and procedures (TTPs) and the ability to leverage frameworks such MITRE ATT&CK, Cyber Kill Chain, Diamon Model, and ATT&CK Navigator to support investigations, threat hunting, and detection engineering activities.
- Proven experience converting threat intelligence into actionable security outcomes, including new detections, hunting hypotheses, correlation rules, watchlists, automated response actions, and security control enhancements.
- Deep experience performing digital forensic investigations across endpoints, servers, Microsoft 365, Azure, cloud workloads, email platforms, identity systems, and hybrid environments.
- Hands-on expertise in forensic evidence acquisition, preservation, chain-of custody management, timeline construction, artifact analysis, memory analysis, malware triage, and root-cause determination.
- Strong analytical skills with experience correlating endpoint telemetry, cloud logs, authentication records, network activity, SIEM data,
- threat intelligence, and forensic artifacts to identify malicious activity and determine business impact.
- Extensive experience conducting proactive threat hunting across Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, CrowdStrike, Microsoft 365, Entra ID, Azure, endpoint telemetry, cloud platforms, network security data sources.
- Expertise developing advanced detection content, including SIEM analytics rules, behavioral detections, KQL hunting queries, automation workflows, enrichment logic, and incident investigation playbooks.
- Hands-on experience with Microsoft security technologies including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, Defender for Identity, Microsoft Purview, Entra ID, and related security monitoring platforms.
- Strong understanding of log analysis, packet analysis, endpoint investigations, cloud security monitoring, attack-path analysis, and forensic validation techniques.
- Experience leading technical response activities during cybersecurity incidents, including containment, eradication, recovery, evidence preservation, executive communications, and post-incident reviews.
- Experience producing high-quality forensic reports, threat intelligence assessments, attack narratives, executive briefings, and technical documentation suitable for legal, audit, compliance, and leadership audiences.
- Knowledge of regulatory and compliance requirements impacting security investigations, including evidence handling, audit readiness, data protection obligations, breach response, and regulatory reporting requirements.
- Strong understanding of security frameworks and best practices including NIST Cybersecurity Framework, NIST 800-61, NIST800-86, NIST 800-53, MITRE ATT&CK, CIS Controls, ISO 27001, and ISO 27035.
- Excellent written and verbal communication skills with the ability to clearly communicate technical investigative findings, threat intelligence assessments, and risk impacts to both technical and non-technical stakeholders.
- Proven ability to act as a senior technical escalation resource, mentor junior analysts, and provide quality oversight for offshore teams, managed security service providers (MSSPs), and security operations partners.
- Strong attention to detail, intellectual curiosity, investigative mindset, and the ability to independently manage high-priority investigations while balancing multiple concurrent security events.
Compensation:- Chicago Base pay range: $187,899 - $234,873 per year
- Nationwide Base pay range: $170,871 - $213,521 per year
This is the range we reasonably expect to pay at hire. Placement within the range depends on job-related factors such as experience, skills, and certifications. This position is not eligible for an annual bonus. Base pay is one part of a total rewards package that includes the benefits listed below.
#iph
All of our jobs come with great benefits including healthcare, parental leave and opportunities for career advancements. Some offerings are dependent upon the location of where you work and can include the following:
- Comprehensive full medical, dental and vision Insurance
- Basic Life Insurance at no cost to the employee
- Company paid short-term and long-term disability
- 12 weeks of 100% paid Parental Leave
- Health Savings Account (HSA)
- Flexible Spending Accounts (FSA)
- Retirement savings plan
- Personal Paid Time Off
- Paid holidays and company-wide Wellness Day off
- Paid time off to volunteer at nonprofit organizations
- Pet friendly office environment
- Commuter Benefits
- Group Pet Insurance
- On the job training and skills development
- Employee Assistance Program (EAP)
Interview Technology Notice:
Please note that phone and video interviews or screenings may be recorded and transcribed using interview technology to support our recruitment process.
By continuing with the interview, you consent to this use.
Text Messaging Notice:
If you provide a mobile phone number, you may receive job-related communications via text message. Message and data rates may apply.
You may opt out of text communications at any time by replying "STOP."
