Principal, SOC Analyst

Our Principal, Security Operations Center (SOC) Analyst serves as the senior technical leader for detecting, investigating, and responding to cyber threats across WPS’s Government and Commercial environments. This Analyst designs threat‑informed detections, leads major incident response efforts from first alert through recovery. They drive the modernization of our core detection and response capabilities, this includes: SIEM, threat hunting, threat intelligence, and security automation.

Our Principal SOC Analyst is positioned within Cyber Threat Management (CTM), and report to our Manager, CTM, they closely partner with Application Security, Cyber Trust & Architecture, Cyber Risk & Assurance, IT Infrastructure, and IT Application Engineering. This Principal-level role will not have direct reports, but will want to and enjoy mentoring SOC analysts, producing the metrics and evidence that leadership uses to demonstrate operating effectiveness and reductions in cyber risk.

Salary Range $125,000 ~ $160,000 The base pay offered for this position may vary within the posted range based on your job-related knowledge, skills, and experience.
Work Location Our first consideration will be to have this employee be able to take advantage of Hybrid work and collaboration, living within the state of Wisconsin. Employees within 45 miles of WPS Headquarters (1717 W. Broadway in Madison, WI, 53713) will be expected to be able to work in office 3 days a week on a regular basis.

How do I know this opportunity is right for me? If you:

• Can design, build, test, and tune threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external‑facing applications; govern detections as code; and serve as the technical lead for SIEM migration detection content and log sources.
• Have led significant security incidents through all phases, including detection, analysis, containment, eradication, recovery, and post‑incident review; maintain and improve incident response playbooks (including ransomware readiness), support required federal and contractual reporting in partnership with Legal, Privacy, and Compliance, orchestrate tabletop and recovery exercises, and participate in on‑call escalation.
• Enjoy defining and architecting the SOC monitoring model and detection architecture for both network environments, preserving data isolation and the regulatory boundaries between them; govern log‑source coverage and data quality against the enterprise asset inventory; and ensure managed service providers meet service levels for log delivery, alert handling, and containment.
• Want to conduct hypothesis‑driven threat hunting activities and translate results into new detections; operationalize threat‑intelligence reporting to prioritize detections, hunts, and vulnerability response; and validate detection effectiveness through adversary‑simulation and purple‑team exercises.
• Like to build and maintain automation, orchestration, and AI‑assisted workflows to streamline alert triage and investigations; govern and communicate key SOC performance metrics that include:
  • Detection coverage, detection and response times, alert quality, and automation rates that support business reviews and executive risk reporting.
• Love providing mentorship and coaching to SOC analysts.
• Can author and govern SOC standard operating procedures, playbooks, and runbooks; represent detection and response in audits, assessments, and vendor engagements, providing operating‑effectiveness evidence from day‑to‑day operations.
• Enjoy working with partner teams to build detection and response requirements into new systems and…