Job Description and Requirements
Randolph-Brooks Federal Credit Union is currently searching for an experienced and talented Principal SOC Engineer to join our amazing IT Security team!
The Principal SOC Engineer will have the ability to work a hybrid schedule (remote/onsite) after a period of training (time frame may vary). Training will take place at the RBFCU Administrative Service Center: 1 Ikea-RBFCU Pkwy, Live Oak, Texas 78233.
All applicants must reside within the state of Texas and have the capability of performing all of the work from their home in Texas.
To successfully work from home, employees must have access to a minimum internet connection as noted by RBFCU.
- Must have a reliable home internet provider and the ability to hard wire a connection directly to modem (Ethernet cable provided).
- Must be able to provide a workspace at home that is safe, suitable for work, and within a distraction free environment
The Principal Security Operations Center Engineer is an enterprise technical leader responsible for shaping the technical strategy, architecture, and evolution of security monitoring, detection, investigation, threat hunting, and incident response capabilities. The role defines how security telemetry, analytics, automation, intelligence, and response controls work together across hybrid infrastructure, cloud, identity, endpoint, network, applications, data platforms, and emerging technologies. The Principal Engineer leads the organization’s most consequential investigative and response decisions, anticipates adversary and technology changes, influences senior leaders, develops technical talent, and ensures that the SOC delivers measurable risk reduction, operational resilience, and trusted decision support during high-impact events.
Essential Functions and Responsibilities:
- Define the multi-year technical strategy, target architecture, engineering principles, standards, and capability roadmap for enterprise security operations and detection and response.
- Lead or advise on the highest-impact, most ambiguous, or most technically complex security incidents, attack campaigns, forensic investigations, and enterprise response decisions.
- Establish enterprise methods for telemetry onboarding, data quality, detection engineering, threat hunting, alert triage, investigation, incident command, automation, evidence, and closure assurance.
- Architect scalable security data, SIEM, XDR, SOAR, case-management, threat intelligence, analytics, automation, and response-control capabilities across the enterprise.
- Define detection and response coverage models mapped to threat scenarios, attack paths, critical assets, business services, control dependencies, and acceptable residual risk.
- Anticipate emerging threats and sponsor cross-functional programs addressing cloud, identity, software supply chain, data, AI, insider, third-party, and advanced persistent threat risks.
- Provide authoritative technical guidance for material incidents, executive decisions, acquisitions, major transformations, regulatory commitments, and strategic security investments.
- Define measurement frameworks connecting telemetry health, coverage, precision, response speed, containment effectiveness, automation, resilience, and incident outcomes to business risk.
- Influence executives and senior security, technology, legal, privacy, communications, risk, and business leaders to prioritize durable detection and response improvements.
- Develop senior technical talent through mentorship, architecture and detection reviews, exercises, communities of practice, succession planning, and external industry engagement.
- All other duties as assigned (note: essential functions and responsibilities may change or new ones may be assigned at any time with or without notice)
Requirements:
- Bachelor’s degree in IT security or related fields. Four years of job-related experience in lieu of bachelor’s degree.
- Minimum 5 years of experience in cybersecurity, information security, cyber defense, security operations, incident response, threat intelligence, detection engineering, or related discipline.
- Demonstrated mastery of incident investigation and command, detection engineering, threat hunting, telemetry architecture, security analytics, automation, adversary behavior, and enterprise risk communication.
- Proven experience designing or materially influencing large-scale SIEM, XDR, SOAR, security data, cloud detection, case-management, or response capabilities.
- Advanced software, automation, query, or data-engineering capability and a strong record of designing maintainable detection, investigation, and response platforms.
- Ability to define strategy and standards while remaining sufficiently hands-on to evaluate telemetry, review critical detections and code, guide prototypes, and investigate novel attack paths.
- Exceptional systems thinking and technical judgment, including the ability to make defensible decisions when evidence is incomplete and tradeoffs span security, safety, availability, legal, privacy, delivery, cost, and customer impact.
- Executive-level written and verbal communication skills, with the ability to frame complex incident risk and uncertainty, build alignment, and influence investment and response decisions.
- Demonstrated leadership through influence, including mentoring senior engineers, resolving conflict, creating clarity in ambiguity, and sustaining multi-year enterprise initiatives.
- High integrity, sound discretion, organizational awareness, composure under pressure, and a consistent record of accountability for enterprise outcomes.
- Experience defining enterprise detection and response architecture across multi-cloud, identity, endpoint, network, application, data, operational technology, or AI environments.
Skills / Certification / Licensing:
- Recognized enterprise authority integrating incident response, detection, hunting, telemetry, forensics, automation, cloud, identity, data, adversary intelligence, and risk.
- Defines strategic problems, creates technical direction, and operates with broad organizational trust and accountability.
- Resolves novel, high-consequence, systemic security operations problems and establishes durable enterprise solutions.
- Shapes organization-wide monitoring architecture, response practices, engineering standards, investments, and risk outcomes.
- Influences executives and senior technical, legal, privacy, risk, communications, and business leaders while reconciling competing priorities.
- Multiplies organizational capability through strategy, standards, mentorship, exercises, communities of practice, and technical stewardship.
- Delivers measurable improvements in detection coverage, investigative confidence, containment effectiveness, operational resilience, and enterprise risk reduction.
