Security Operations Engineer

Modis is seeking a Security Operations Engineer for a 12+ months Contract position with a client located in Alameda, CA.

Pay Range: $86/hr. - $96/hr. On W2 (The rate may be negotiable based on experience, education, geographic location, and other factors.)

Job Description:

The Staff Engineer, Cybersecurity is responsible for supporting day-to-day cybersecurity operations while helping improve team efficiency through targeted automation initiatives. Working within a small cybersecurity team, this individual will serve as a primary resource for operational ticket handling, security investigations, user requests, and security process execution.

The role requires developing a deep understanding of existing cybersecurity workflows, technologies, and business processes. While the primary focus is executing and managing operational work, the Staff Engineer will also identify opportunities to automate repetitive tasks and leverage SOAR and workflow automation platforms to improve consistency, reduce manual effort, and increase operational efficiency.

Success in this role will be measured by operational excellence, ticket quality, responsiveness, and the ability to incrementally reduce manual workload through practical automation.

Responsibilities:

Cybersecurity Operations (80%)

Operational Ticket Management:

• Manage and resolve cybersecurity-related tickets and service requests.
• Perform triage, investigation, escalation, and resolution activities in accordance with established procedures.
• Ensure timely responses to operational requests and security events.
• Document investigations, findings, and remediation actions within ticketing systems.
• Maintain awareness of ticket queues and ensure service levels are met.

Security Investigations:

• Investigate suspicious activity, security alerts, and user-reported concerns.
• Perform account compromise, phishing, identity, endpoint, and access-related investigations.
• Gather and analyze evidence from security tools and platforms.
• Escalate complex incidents when appropriate.
• Support incident response activities during security events.

Operational Process Execution:

• Execute established security procedures and playbooks.
• Support user access reviews, security assessments, and operational security tasks.
• Coordinate with IT and business stakeholders to resolve operational issues.
• Maintain accurate operational documentation and procedures.
• Identify recurring issues and recommend process improvements.

Security Platform Operations:

• Utilize security tools to investigate and respond to operational events.
• Support monitoring and administration of cybersecurity technologies.
• Validate security alerts and determine appropriate actions.
• Assist with security control testing and operational validation activities.

Automation and Continuous Improvement (20%)

Workflow Automation:

• Identify repetitive and time-consuming operational tasks suitable for automation.
• Develop, test, and maintain SOAR workflows and automation playbooks.
• Improve consistency and repeatability of operational procedures.

Process Optimization:

• Analyze ticket trends and operational metrics.
• Recommend improvements that reduce manual effort and increase efficiency.
• Develop documentation for automated workflows and processes.
• Measure automation effectiveness and operational benefits.

Required Qualifications:

Education:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related discipline; or equivalent combination of education and experience.

Experience:

• 5+ years of experience in cybersecurity operations, incident response, security engineering, or a related field.
• 5+ years of experience investigating cybersecurity events and security alerts.
• 5+ years of experience working within a ticket-driven operational environment.
• 5+ years of experience supporting security technologies and operational processes.
• 2+ years of experience with scripting, automation, or workflow orchestration platforms preferred.

Technical Skills:

Experience with all of the following:

• Security Operations Center (SOC) processes
• Incident Response
• Identity and Access Management
• Microsoft 365 Security
• Okta
• Endpoint Detection and Response (EDR/XDR)
• SIEM platforms
• Email Security
• Cloud Security (Azure/AWS)
• ServiceNow, Jira, or similar ticketing platforms
• Security investigation and threat analysis
• SOAR platforms such as Tines, Cortex XSOAR, Splunk SOAR, or Microsoft Sentinel Automation
• PowerShell, Python, JavaScript, or similar scripting languages

Key Performance Indicators:

• Timely handling and resolution of operational tickets.
• Quality and completeness of investigations.
• Adherence to operational procedures and service levels.
• Reduction in manual effort through automation.
• Number and effectiveness of implemented workflow improvements.
• Accuracy and quality of documentation.
• Contribution to overall team efficiency and scalability.

Characteristics of a Successful Candidate:

• Strong operational mindset with attention to detail.
• Comfortable managing a high volume of tickets and investigations.
• Naturally curious and investigative.
• Able to independently prioritize and execute work.
• Process-oriented and focused on continuous improvement.
• Practical experience automating repetitive tasks.
• Effective collaborator in a small, fast-moving team environment.

If you are interested in this Security Operations Engineer role in Alameda, CA then please contact me at (610 998 7407) or [email protected].

Equal Opportunity Employer/Veterans/Disabled

Benefit offerings available for our associates include medical, dental, vision, life insurance, short-term disability, additional voluntary benefits, an EAP program, commuter benefits, and a 401K plan. Our benefit offerings provide employees the flexibility to choose the type of coverage that meets their individual needs. In addition, our associates may be eligible for paid leave including Paid Sick Leave or any other paid leave required by Federal, State, or local law, as well as Holiday pay where applicable.

Disclaimer: These benefit offerings do not apply to client-recruited jobs and jobs that are direct hires to a client.

To read our Candidate Privacy Information Statement, which explains how we will use your information, please visit Website Privacy Policy | Modis

The Company will consider qualified applicants with arrest and conviction records in accordance with federal, state, and local laws and/or security clearance requirements, including, as applicable:

· The California Fair Chance Act

· Los Angeles City Fair Chance Ordinance

· Los Angeles County Fair Chance Ordinance for Employers

· San Francisco Fair Chance Ordinance