Security Operations & Incident Response

Position: Security Operations & Incident Response

Location: Rock Springs, WY

Duration: 36+ Months and Extendable

Client: Western Wyoming Community College

Remote is fine. Onsite incident response available as needed

Certifications (required: at least one of): GIAC GCIH, GCIA FA; CISSP. Preferred: Microsoft SC-200, GIAC GNFA, EC-Council ECIH.

Description:

Key responsibilities:
• Design and run 24/7/365 security monitoring and threat detection for WWC: hours of active monitoring, technology, alert triage and escalation, and the response actions WWC pre-approves.
• Onboard WWC log sources into SIEM/XDR, preferably Microsoft Sentinel and Defender XDR under M365 A5: Entra ID, Exchange Online, endpoints (Intune and Jamf managed), firewalls, servers and the Colleague SQL environment.
• Build and tune detection use cases for higher-ed threats: credential stuffing on student accounts, business email compromise, financial aid fraud, ransomware and MFA fatigue.
• Author and maintain the incident response plan, playbooks and escalation matrix aligned with NIST SP 800-61.
• Lead technical incident response: containment, eradication, recovery, evidence handling and coordination with forensics or IR retainer partners.
• Run annual incident response tabletop exercises with WWC leadership and IT.
• Run threat hunting and threat intelligence (including REN-ISAC and CISA advisories).
• Produce monthly SOC metrics: alert volumes, mean time to detect, mean time to respond, incidents and trends.

Deliverables owned: the SOC service model and runbook, incident response plan and playbooks, tabletop exercise reports, monthly SOC/MDR reports, and post-incident reports.

Experience: 12+ years in security operations, including 6+ years leading a SOC, MDR or incident response team

Required qualifications:
• 12+ years in cybersecurity operations, with 6+ years leading SOC, MDR or DFIR teams.
• Hands-on expertise with Microsoft Sentinel (KQL), Defender XDR and Entra ID; experience with another SIEM such as Splunk or QRadar is a plus.
• Led response to ransomware, business email compromise and data exposure incidents, including regulatory notification support (FERPA, GLBA, state breach laws).
• Knowledge of the MITRE Telecommunication&CK framework, NIST SP 800-61 and evidence chain of custody.
• Bachelor's degree in Cybersecurity or Computer Science, or equivalent experience.

Preferred: SOC experience for colleges, universities or K-12 / public sector; experience running a cyber insurance-aligned IR retainer.