Incident Response Analyst II

About the role

If you’re passionate about building a better future for individuals, communities, and our country—and you’re committed to working hard to play your part in building that future—consider WGU as the next step in your career. Driven by a mission to expand access to higher education through online, competency‑based degree programs, WGU is also committed to being a great place to work for a diverse workforce of student‑focused professionals. The university has pioneered a new way to learn in the 21st century, one that has received praise from academic, industry, government, and media leaders. Whatever your role, working for WGU gives you a part to play in helping students graduate, creating a better tomorrow for themselves and their families.

Responsibilities

• Serve as a lead analyst for incident response and related security efforts, including digital forensics, continuous monitoring, intrusion detection and prevention, penetration testing, integration, and automation.
• Investigate security events and unusual activity using SIEM, IDS/IPS, endpoint security, DLP, HIPS, EPP, client proxy, firewalls, and other security technologies.
• Analyze phishing emails, logs, network traffic, alerts, and other security telemetry using industry‑standard tools to identify malicious, suspicious, or anomalous behavior.
• Lead or participate in tactical response efforts to investigate and address identified security risks across technical environments.
• Develop and refine SIEM security rules and security use cases aligned with the MITRE ATT&CK Framework.
• Collaborate with architects, risk professionals, infrastructure teams, and security specialists to build and integrate detective, preventive, and corrective security controls.
• Improve incident response and security operations through documentation, automation, lessons learned, Correction of Errors (CoE), and the development of more effective security practices.

Requirements

Required:

• Bachelor's Degree in IT Security, Computer Science, Engineering, or related field.
• 3 years of Information Security experience.
• Experience analyzing SIEM, network, event, security, and IDS alert logs.
• Experience working with MITRE ATT&CK Framework.
• Experience with security industry standards and best practices, specifically with interpreting and implementing those standards in a corporate environment.
• Scripting language experience (Bash, Python, etc.) with strong working knowledge of automation.
• Experience working with compliance and regulatory program requirements.
• Experience designing and deploying security solutions.
• Knowledge and experience in incident handling, computer forensics, intrusion detection systems, firewalls, antivirus, syslog, and related security technologies.
• Strong understanding of SIEM content security rules to detect malicious, suspicious, and/or abnormal events.
• Working knowledge of intrusion detection methodologies, network traffic analysis, sensor tuning, and interpreting signatures.
• Understanding of AWS services, cloud security principles, CI/CD security, infrastructure‑as‑code, and data encryption strategies.
• Excellent analytical, problem‑solving, decision‑making, written, and verbal communication skills.

Preferred (bonus points):

• 8 years of Information Security experience.
• Experience recommending additional security requirements and safeguards.
• Experience in the development of end‑user operating manuals and documentation.
• Familiarity with Cloud infrastructure.
• Relevant security certifications (CISSP, GIAC, ISACA, CCSP, CCSK, AWS, etc.).

Benefits

• Medical, dental, vision, telehealth and mental healthcare.
• Health savings account and flexible spending account.
• Basic and voluntary life insurance.
• Disability coverage.
• Accident, critical illness and hospital indemnity supplemental coverages.
• Legal and identity theft coverage.
• Retirement savings plan.
• Wellbeing program.
• Discounted WGU tuition.
• Flexible paid time off for rest and relaxation (no accrual needed).
• Flexible paid sick time (no accrual needed).
• 11 paid holidays.
• Other paid leaves, including up to 12 weeks of parental leave.
• Eligibility for bonuses.

Pay

Grade: Technical 407 Pay Range: $108,200.00 - $162,400.00. At WGU, it is not typical for an individual to be hired at or near the top of the range for their position, and compensation decisions are dependent on the facts and circumstances of each case.

Schedule

This is a full-time, in‑office position requiring five days per week in either the Salt Lake City, Utah or Raleigh, North Carolina office. The role works a swing shift of 3:00 p.m. to 12:00 a.m., aligned to either Eastern or Mountain Time, and is scheduled for 40 standard weekly hours.