Principal Security Architect - Cyber Operations and Incident Response

City of Hope is a healthcare and research organization focused on treating cancer, diabetes, and other life-threatening illnesses. The Principal Security Architect will serve as the senior technical authority for enterprise cyber operations, detection, monitoring, incident response, and cyber defense architecture. The role leads security strategy, detection engineering, threat intelligence integration, cyber resilience, and technical guidance across security and technology teams.

Responsibilities:

• Define and maintain enterprise architecture, standards, and roadmaps for SOC operations, SIEM, SOAR, UEBA, threat intelligence, digital forensics, incident response, and cyber defense platforms
• Lead the design and optimization of enterprise detection engineering programs, security monitoring capabilities, threat hunting frameworks, use-case development, and adversary detection strategies aligned with MITRE ATT&CK and industry best practices
• Architect and enhance incident response, forensic investigation, cyber resilience, ransomware recovery, and crisis management capabilities across enterprise environments
• Lead assessment and improvement of security telemetry, log management, detection coverage, alert fidelity, incident workflows, automation opportunities, and response processes
• Partner with security engineering teams to ensure security technologies generate adequate logging, visibility, and actionable telemetry to support detection and response objectives
• Provide strategic leadership and technical guidance to SOC analysts, incident responders, threat hunters, detection engineers, and management teams. Develop documentation, standards, executive metrics, and board-level reporting
• Evaluate emerging threats, adversary techniques, AI-assisted attack methods, security operations technologies, and threat intelligence capabilities to enhance organizational cyber defense effectiveness
• Follows established City of Hope and department policies, procedures, objectives, performance improvement, attendance, safety, environmental, and infection control guidelines, including adherence to the workplace code of Conduct and Compliance Plan
• Practices a high level of integrity and honesty in maintaining confidentiality
• Performs other related duties as assigned or requested

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Management Information Systems, Computer Information Systems, Computer or Electrical Engineering, or a related field
• Three additional years of relevant experience may substitute for the minimum education requirement
• Nine years or more of progressive cybersecurity experience with significant depth in security architecture, security engineering, or both; or a master's degree and seven years of relevant experience
• Demonstrated experience designing security controls across complex, multi-vendor enterprise environments and applying risk analysis, risk assessment, and risk management practices
• Master's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or another technology-related field
• CISSP, GCIH, GCFA, GCIA, GMON, GNFA, GCFE, GRID, SC-200, or equivalent advanced security operations and incident response certifications
• Leadership of enterprise SOC, incident response, detection engineering, or cyber defense programs
• Deployment and optimization of SIEM, SOAR, UEBA, NDR, EDR/XDR, and threat intelligence platforms
• Threat hunting, adversary emulation, digital forensics, and malware analysis programs
• Cybersecurity operations within healthcare, life sciences, or another highly regulated industry
• Managed SOC providers, co-sourced security operations, and security service governance
• Security metrics, detection maturity assessments, and cyber resilience program development