Senior Security Operations Engineer

At Affinity Plus every employee understands how their work affects our members experience and we strive to provide an experience that can't be found anywhere else. Great service starts with great employees and that is why we focus on providing not only the best place our members will ever bank but the best place our employees will ever work. Between our one of a kind culture, incredible benefits, and work/life balance; we believe you will feel the Affinity Plus difference.

 

Position Summary

The Senior Security Operations (Sec Ops) Engineer is a hands‑on senior individual contributor responsible for defending the organization against advanced cyber threats through high-fidelity detection, rapid response, and resilient security operations. This role anchors production incident response while owning and continuously improving the organization’s SIEM and detection engineering capabilities. This position is Splunk‑first, with primary tool ownership of Splunk Enterprise Security, including detection, content lifecycle management, alert quality, performance optimization, and platform reliability. The Senior SecOps Engineer partners closely with Information Security, IT, Cloud, Infrastructure, and Security Architecture teams to measurably improve threat visibility, response efficiency, and the overall maturity of security operations.

 

Duties & Responsibilities:

Security Monitoring & Incident Response

• Support investigation and response activities for security incidents by collaborating closely with Information Security, responding to alerts generated by SIEM, EDR, cloud security, and other security platforms.
• Investigate high‑severity and complex incidents coordinating escalation as needed with Information Security and IT teams.
• Support incident response activities during major security events with Information Security, IT and Cloud teams under the direction of designated incident response leadership.
• Partner with response teams to develop and communicate risk‑based response decisions, including containment actions, during active incidents.
• Perform deep-dive forensic analysis and root-cause investigations following security events and recommend control improvements to prevent recurrence
• Participate in and help coordinate a 24/7 on-call rotation, responding to after-hours incidents as required

Detection Engineering & Threat Hunting

• Design end‑to‑end detection lifecycle in Splunk Enterprise Security, from hypothesis and development through production deployment, tuning, and retirement
• Design, build, and tune high quality signal detections that reduce false positives and improve mean time to detect and respond
• Conduct proactive threat hunting using SIEM, endpoint, identity and cloud telemetry to identify hidden or emerging threats
• Analyze logs and telemetry to identify trends, anomalous behavior, and indicators of compromise
• Leverage query languages such as SPL and KQL to build effective detection and investigative workflows

Security Tooling & Automation

• Build, operate, and optimize Endpoint Detection and Response (EDR) solutions with a focus on scalability and automation
• Provide subject matter expertise on detection engineering and SIEM architecture to security and IT partners
• Support SIEM operations through use case placement, data routing decisions, and ongoing platform enhancements
• Serve as a subject matter expert for SIEM and detection engineering, providing guidance on logging, telemetry, and monitoring design
• Collaborate on SOAR and security automation initiatives to streamline response and remediation workflows
• Continuously evaluate tooling capabilities and recommend pragmatic improvements aligned to operational needs

Vulnerability & Risk Management

• Act as the lead IT representative in vulnerability management processes, partnering with Information Security on risk prioritization, remediation coordination, validation, and reporting.
• Apply or coordinate approved security patches and upgrades for vulnerable systems and platforms
• Partner with system owners to ensure timely remediation of critical vulnerabilities
• Utilize vulnerability management platforms (e.g., Rapid7 InsightVM) to identify, prioritize, and track remediation of security risks.

Microsoft & Enterprise Security Platforms

• Operate and optimize Microsoft security technologies including Microsoft Sentinel, Defender, Entra ID, Intune, and Purview
• Ensure relevant Microsoft and cloud telemetry is effectively ingested into Splu