Principal Security Operations Engineer

Principal Security Operations Engineer

Location: Walnut Creek, CA; Phoenix, AZ; or Honolulu, HI

Employment Type: Full-Time, Direct Hire

Compensation

Walnut Creek or Honolulu- DOE 160-195k

Phoenix- DOE 150-175k

Note: No C2C or C2H arrangements will be considered. This is a direct contract engagement only. No agencies.

Third-party recruiters, agencies, and vendor representatives: Do not contact personal phone numbers, household members, or any non-business contact associated with StratITech employees or representatives. Any attempt to use personal or household contact information for solicitation, candidate submission, or vendor outreach is strictly prohibited and will be reported to LinkedIn.

About the Role

We are seeking a Principal Security Operations Engineer to serve as a senior technical leader for cybersecurity incident response, security operations, and infrastructure-level investigation across a complex, distributed enterprise environment.

This is not a traditional SOC analyst role and not a purely managerial security operations position. The right candidate will be able to lead high-severity cybersecurity incidents while also going deep technically across firewalls, DNS, Active Directory, endpoint telemetry, cloud logs, SIEM/logging pipelines, and network security infrastructure.

The organization uses external monitoring and managed detection support for initial alerting. Escalated events require an internal security leader who can validate the signal, determine scope, coordinate containment, guide technical teams, communicate risk to leadership, and drive incidents through remediation, root-cause analysis, and post-incident improvement.

What You’ll Do

• Serve as Incident Commander for high-severity cybersecurity incidents, owning response from triage through containment, remediation, recovery, root-cause analysis, and post-incident review.
• Validate escalations from managed detection providers and determine whether suspicious activity represents true compromise, false positive, misconfiguration, or business-approved behavior.
• Investigate incidents across firewall logs, DNS logs, endpoint telemetry, Active Directory events, cloud audit logs, SIEM data, vulnerability data, and third-party security alerts.
• Lead infrastructure-level security investigations involving TCP/IP traffic, firewall state tables, NAT, ephemeral ports, DNS forwarding, suspicious authentication, anomalous cloud activity, endpoint compromise, and Active Directory risk.
• Partner with infrastructure, network, endpoint, cloud, and application teams to determine scope, implement containment, confirm root cause, and verify remediation.
• Improve incident response processes, escalation paths, runbooks, tabletop exercises, communication templates, and post-incident review practices.
• Help improve asset visibility by correlating data from Active Directory, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB sources, and network telemetry.
• Communicate clearly with technical teams, executives, legal/compliance stakeholders, and external partners during active incidents.

Required Experience

• Senior-level experience in cybersecurity incident response, security operations, cyber defense, or principal-level security engineering.
• Demonstrated experience serving as an Incident Commander, Incident Response Lead, SOC escalation leader, or senior incident owner for high-severity cybersecurity incidents.
• Proven ability to lead incidents from initial triage through containment, remediation, root-cause analysis, post-incident review, and operational improvement.
• Strong understanding of TCP/IP fundamentals, including source/destination ports, ephemeral ports, NAT, firewall state tables, and stateful inspection.
• Ability to interpret firewall logs, connection logs, NAT behavior, blocked/allowed traffic, and network security events during an investigation.
• Experience investigating DNS-based threats, including DGA alerts, suspicious domain activity, DNS forwarding, passive DNS, DNS server logs, and identifying the originating host behind suspicious DNS requests.
• Strong understanding of Active Directory security and compromise response, including administrator workstation compromise, credential exposure, lateral movement risk, Tier 0 assets, and domain controller investigation.
• Experience with SIEM/logging architecture and troubleshooting, ideally Splunk or a comparable platform.
• Understanding of syslog limitations and log transport challenges, including UDP syslog, packet loss, TCP syslog, buffering, spooling, and store-and-forward logging designs.
• Experience validating asset inventory and exposure using sources such as AD, DNS, DHCP, EDR, vulnerability scanners, cloud inventories, CMDB records, and network telemetry.
• Strong communication skills with the ability to brief executives, coordinate technical teams, and communicate business risk during active security incidents.

These Skills Are a Plus

• Experience in transportation, logistics, maritime, shipping, industrial, critical infrastructure, or other distributed operational environments.
• Experience supporting remote offices, branch networks, ships, satellite links, or high-latency / low-reliability network environments.
• Experience with Splunk architecture, including Universal Forwarders, indexers, search heads, CIM normalization, indexer acknowledgment, queue troubleshooting, and Splunk internal logs.
• Experience with Palo Alto, Fortinet, Check Point, Cisco, or similar firewall and network security platforms.
• Experience with Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, or other EDR/XDR platforms.
• Digital forensics experience across endpoint, network, cloud, identity, or email investigations.
• Experience with ransomware, business email compromise, credential theft, Mimikatz, lateral movement, suspicious authentication, cloud account compromise, or third-party compromise scenarios.
• Experience working with MDR/MSSP providers such as ReliaQuest or similar managed detection partners.

What Success Looks Like

The right person can take a vague or incomplete security signal, determine whether it matters, identify what data is missing, pull in the right teams, make containment recommendations, communicate clearly, and drive the incident to closure.

This role requires both calm incident leadership and hands-on technical credibility across security operations, infrastructure, logging, network, identity, and endpoint environments.