Principal Information Security Operations Engineer

Principal Information Security Operations Engineer

Location:

Walnut Creek, California;
Phoenix, Arizona;
Honolulu, Hawaii

Salary: USD 139, Annually

Position at Matson Navigation Company, Inc. The role involves leading cybersecurity incident response, coordinating cross‑functional response efforts, ensuring incidents are handled quickly, and maintaining security monitoring and alerting tools.

• Manage day‑to‑day security operational tasks such as security event monitoring, log monitoring and security incident management, compliance monitoring, data loss prevention, and monitoring and responding to emerging threats ranging from endpoint to server to public cloud.
• Lead all security‑related events and incidents that come into the team’s various queues (including triage, containment, and remediation when necessary). Follow standard operating procedures (SOPs) and playbooks to ensure security events are triaged appropriately and in a timely manner, according to SLAs.
• Understand the various stages of the incident response lifecycle and the analytical mindset for triage and investigations, including a fundamental understanding of memory processes and memory management practices, or the willingness to learn these principles. Act as primary support contact for security incidents and provide direction to infrastructure and applications teams to initiate incident response.
• Perform root‑cause analysis to continuously improve prevention, detection, reaction, and remediation capabilities.
• Ensure systems, networks, and applications are monitored for security breaches, intrusions, and unusual activity.
• Investigate and respond to security events and incidents, including performing root‑cause analysis, identifying vulnerabilities, and implementing remediation and/or tuning measures.
• Respond to phishing attacks by tracking down and recalling malicious e‑mails; contact users who may be impacted.
• Participate in off‑hours on‑call rotation, as required.
• Liaise with internal and external parties, including Managed Security Services Provider, computer forensics specialists, and additional incident responders, to address security concerns.
• Assist in managing the organization’s logging environment providing fundamental knowledge of license managers, indexers, and search heads.
• Develop SOAR playbooks to minimize security incident response time and develop advanced techniques to identify and mitigate vulnerabilities.
• Understand security incident response plans and procedures, ensuring their effectiveness through regular testing and exercises.
• Collaborate with cross‑functional teams to ensure security controls, infrastructure, and tools, including firewalls, intrusion detection systems, data loss prevention systems, and security information and event management (SIEM) systems are implemented and maintained throughout the organization.
• Conduct research on emerging security threats and trends and recommend appropriate security measures and countermeasures.
• Assist in developing security policies, controls, and procedures to support the full life cycle protection of critical assets, networks, cloud environments, and sensitive information.
• Perform periodic testing for compliance with documented security policies, procedures, and standards.
• Support metrics reporting on security operations functions.

• Strong information security operations analytical skills, including those commonly handled by a Security Operations Center (SOC), including Tier 2 and 3 level skills.
• Strong knowledge of network security protocols, tools, and technologies (BGP, TCP/IP layers, DNS, SMTP, SSL, etc.).
• Strong understanding of network and system architecture, including cloud‑based environments (AWS).
• Experience and knowledge of network firewalls, network monitoring tools and other IDS/IPS.
• Experience with security incident response and handling techniques.
• Proficiency in using SIEM tools for log analysis and correlation.
• Familiarity with vulnerability management tools and processes.
• Technical knowledge in system and network security, authentication and security protocols, and application security.
• Strong understanding of web technologies…