IT Security Analyst-Incident Response

If you’re passionate about building a better future for individuals, communities, and our country—and you’re committed to working hard to play your part in building that future—consider WGU as the next step in your career.

Driven by a mission to expand access to higher education through online, competency-based degree programs, WGU is also committed to being a great place to work for a diverse workforce of student-focused professionals. The university has pioneered a new way to learn in the 21st century, one that has received praise from academic, industry, government, and media leaders. Whatever your role, working for WGU gives you a part to play in helping students graduate, creating a better tomorrow for themselves and their families.

Pay Range: $ - $

• Lead complex incident response and investigation efforts, including technical analysis, evidence and data collection, forensic support, containment, remediation, and identification of opportunities to strengthen defenses.
• Lead security content and detection use‑case development aligned to the MITRE ATT&CK Framework, researching attacks, identifying Indicators of Compromise (IOCs), analyzing large data sets, and developing detection logic for malicious, suspicious, and abnormal activity.
• Architect and build cloud threat analytics using log correlation, AI, and machine learning capabilities, while developing continuous security and compliance checks across AWS and other cloud platforms.
• Design and implement SOAR and security automation that improves security configuration management, compliance enforcement, investigation workflows, and remediation of malicious activity.
• Build and automate security capabilities across cloud infrastructure, CI/CD pipelines, infrastructure‑as‑code, data security, DLP, encryption, and security tooling.
• Identify gaps in the security model and lead technical solutions from requirements and architecture through implementation, integration, and ongoing operation, including integrations with Service Now.
• Act as a technical lead and mentor for other analysts, researching emerging threats and techniques, developing team capabilities, and providing hands‑on guidance during demanding security situations.

• Bachelor’s Degree in IT Security, Computer Science, Engineering, or related field
• 7 years of Information Security experience, including understanding of all security domains
• Hands‑on experience implementing MITRE ATT&CK Framework
• Working experience creating, designing, and implementing SIEM content security rules to detect malicious, suspicious, and/or abnormal events
• Hands‑on experience maintaining cloud resources using infrastructure‑as‑code (Cloud Formation, CDK, etc.)
• Expert scripting language experience (Bash, Python, etc.) with strong working knowledge of automation
• Experience with open‑source security tools (i.e. Kali, Nessus, Fortify, App Scan, Nexpose, SAINT, Burp, NMap, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack‑ng, Eramba, etc)
• Hands‑on experience with AWS APIs, Lambda, DynamoDB, EC2, VPC, Cloud Front, Cloud Trail, Cloud Watch, IAM
• Relevant security certifications (CISSP, GIAC, ISACA, CEH, etc.)
• Knowledge and experience with Cloud and Data security, including advanced understanding of core AWS compute, network, storage, database, and identity services
• Hands‑on experience integrating security into the various stages of a CI/CD pipeline
• Expertise in SaaS, PaaS, enterprise cloud architecture, and mixed‑technology security solutions
• Ability to lead in a fast‑paced, multidisciplinary environment while using a methodical, data‑driven approach to security and risk analysis
• Excellent analytical, problem‑solving, decision‑making, and communication skills, with the ability to turn complex…