Incident Response Analyst – Agentic SOC

🔥 1 minute ago

🌲 North Carolina, Texas, +1 more states – Remote

🌲 North Carolina – Remote 🤠 Texas – Remote ☕ Washington – Remote

💵 $116.6k - $147.9k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

🚨 Incident Response Analyst

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Cisco

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1984

🔧 Hardware

🔐 Security

🏢 Enterprise

Hardware • Security • Enterprise

Cisco is a multinational technology company that provides networking hardware, software, and services to enterprises, service providers, and governments. It builds routers, switches, optical transceivers, programmable silicon, and edge computing platforms, and offers security, collaboration (Webex), observability, and AI-enabled software and support services to help organizations design, operate, and secure large-scale networks and data centers. Cisco also delivers professional services, training, and cloud-managed solutions to support digital transformation and AI-ready infrastructure.

📋 Description

• Investigate incidents in Splunk’s global 24/7 SOC • Build, evaluate, and harden agentic tooling used in investigations • Triage, investigate, and respond to alerts across Splunk product and enterprise environments • Use agentic triage and enrichment, validate verdicts, and scope incidents with Splunk Enterprise Security, Mission Control, SPL, EDR, identity, and cloud tooling • Collect evidence, document findings, and drive containment of critical issues • Partner with Detection Engineering to tune detections, reduce false positives, and close coverage or data-quality gaps • Build and maintain agent skills, prompts, MCP servers, SOAR playbooks, and enrichment lookups • Manage GitLab merge requests and code reviews • Convert recurring manual procedures into tested, documented agent workflows and maintain runbooks • Evaluate tooling using real-alert test cases, accuracy and false-verdict tracking, approval gates, autonomy limits, audit trails, and security defenses • Run pre-release Splunk security AI as Customer Zero • Deliver structured findings to Enterprise Security, SOAR, and AI product teams • Work a four-day schedule on either Wednesday–Saturday or Sunday–Wednesday, 12:00 p.m.–10:00 p.m. Central Time

🎯 Requirements

• 4+ years of experience in security operations, incident response, or security monitoring • Experience with alert triage and investigation using SIEM, EDR, identity, and cloud tooling • Knowledge of incident response processes and common attacker techniques • Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud • Experience writing and troubleshooting security searches in SPL, KQL, SQL, or a similar query language • Experience reading and modifying Python or Bash automation • Experience with YAML/JSON configuration and playbooks using Git workflows, branches, merge requests, and code review • Experience using LLM-based or agentic tools and verifying outputs against raw evidence • Experience with Splunk Enterprise Security 8 (Mission Control), Splunk SOAR, or Splunk AI Assistant preferred • Experience building agent tools or integrations, including LLM tool calling, MCP servers, or RAG preferred • Experience designing evaluations for LLM or agent output and running them in GitLab CI/CD pipelines preferred • Knowledge of AI security risks, including OWASP Top 10 for LLM Applications, prompt injection, and model data-handling controls preferred • Clear written communication for investigation notes, runbooks, and explanations of incorrect agent conclusions

🏖️ Benefits

• Medical, dental and vision insurance • 401(k) plan with a Cisco matching contribution • Paid parental leave • Short- and long-term disability coverage • Basic life insurance • Cisco restricted stock unit grants may be available • 10 paid holidays per full calendar year • 1 floating holiday for non-exempt employees • 1 paid day off for employee’s birthday • Paid year-end holiday shutdown • 4 paid days off for personal wellness • 16 days of paid vacation per full calendar year for non-exempt employees • Flexible vacation time off program for exempt employees • 80 hours of sick time off provided on hire date and each January 1st thereafter • Up to 80 hours of unused sick time carried forward annually • Additional paid time away for critical or emergency family issues • Optional 10 paid volunteer days per full calendar year • Annual bonuses for non-sales roles, subject to Cisco policies • Performance-based incentive pay for sales-plan employees