Cyber security principal (Remote)

This is an opportunity to join a large healthcare-focused organization as a Cyber Security Principal supporting enterprise Security Operations. This fully remote, contract role is open to candidates located anywhere in the United States and focuses heavily on security automation, incident response, and Security Orchestration, Automation, and Response (SOAR) initiatives. The position is ideal for someone with strong Cortex XSOAR, Python, and security operations experience who enjoys building automation that improves the speed and effectiveness of cyber defense teams.
What makes this opportunity especially compelling is the chance to work at scale, partnering directly with incident responders and security analysts to streamline investigations and enhance detection and response capabilities. You'll have the opportunity to design meaningful automation, reduce manual effort across the security lifecycle, and make a measurable impact on security operations while working remotely during standard business hours.

Required Skills & Experience

• Experience developing and supporting Cortex XSOAR playbooks and automations
• Strong Python development skills
• Incident Response experience
• Security investigations and data analysis experience
• Experience with Splunk or comparable Security Information and Event Management (SIEM) platforms
• Knowledge of cybersecurity operations, threat detection, and threat response
• High School Diploma required
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field preferred

Desired Skills & Experience

• CrowdStrike
• Proofpoint
• Tanium
• Microsoft Azure
• Digital Forensics
• Networking and Network Security

What You Will Be Doing

• Design, develop, and maintain Cortex XSOAR playbooks and security automations
• Support Incident Response teams throughout the security incident lifecycle
• Define, document, and implement new SOAR use cases and automation requirements
• Analyze security events and create actionable response workflows
• Perform root cause analysis on security incidents
• Develop security analytics and threat intelligence capabilities using SIEM data
• Investigate anomalous security activity and document findings
• Conduct vulnerability assessments and recommend remediation actions
• Enhance security monitoring, reporting, and operational processes
• Collaborate with cross-functional security teams to strengthen detection and response capabilities

Tech Breakdown

• Cortex XSOAR
• Python
• Splunk and SIEM Technologies
• Security Operations and Incident Response
• Microsoft Azure
• CrowdStrike, Proofpoint, and Tanium

Daily Responsibilities

• Hands-on security automation, playbook development, and incident response support
• Security investigation, threat analysis, and root cause analysis
• Collaboration with security operations, engineering, and response teams to improve detection and remediation processes