Mission:
- The Office of Information Technology enables campus priorities
by providing high-value IT services and solutions.
Values:
- Trust, as a foundation for how we engage with one another and
with campus partners, along with
- Avid curiosity in how to better support the campus and our
partners while
- Fostering empowerment and authentic engagement among ourselves
and
- Celebrating inclusivity that promotes a sense of belonging
while acknowledging that each person is unique and valued.
Strategy:
- OIT will advance learning and discovery by delivering
high-value reliable IT services and solutions that:
- Provide a fluid and adaptable academic and student
experience
- Enable research competitiveness and
- Deliver core infrastructure and enterprise IT services for
business effectiveness
What Your Key Responsibilities Will Be
Duties and responsibilities of the position include, but are not
limited to:
Incident Response and Technical Investigation
- Lead or support cybersecurity incidents through identification,
scoping, analysis, containment, eradication, recovery, and
post-incident review.
- Coordinate technical response activities with information
security personnel, IT service providers, system owners, and other
authorized partners.
- Analyze endpoint, network, email, identity, cloud, application,
and other relevant telemetry to establish incident scope, attack
path, affected assets, and required corrective action.
- Develop incident timelines, document technical findings, and
prepare reports that describe root cause, business implications,
response actions, and recommended improvements.
- Manage or support the technical operation of the university’s
email-threat detection and response capabilities, including
analysis of false positives, missed detections, and user-submitted
reports.
- Identify recurring control failures and recommend sustainable
technical improvements.
Detection Engineering, SIEM, and Security Monitoring
- Serve as a technical owner for SIEM and related monitoring
capabilities, including log onboarding, data routing, parsing,
enrichment, normalization, retention, access control, platform
health, and integration reliability.
- Design, develop, test, deploy, document, and tune detections
across endpoint, network, email, identity, cloud, application, and
other relevant data sources.
- Develop dashboards, searches, alerts, reports, and coverage
metrics that support operational monitoring, investigation, and
leadership awareness.
- Develop and maintain automated enrichment, triage,
notification, containment, and response workflows.
- Use threat information, incident findings, and changes in
university technology to identify and close monitoring gaps.
- Partner with service owners to establish appropriate logging,
monitoring, alerting, and incident-response requirements.
Documentation, Consulting, and Technical Leadership
- Maintain and develop incident-response playbooks, runbooks,
escalation procedures, investigative methods, and technical
response documentation.
- Translate technical findings into clear risk and remediation
recommendations for technical and nontechnical audiences.
- Provide subject-matter consultation to technology providers and
system owners concerning monitoring, response, logging, and control
improvement.
- Mentor colleagues and student employees, when assigned.
What You Should Know
- This position is in a hybrid work situation. It offers
remote-work flexibility, but requires periodic campus presence for
evidence collection, investigations, operational needs, and other
activities requiring physical access.
- The work schedule will require after hours as required during
incident response.
- Visa sponsorship is not available for this position.
- Due to the requirement to access export-controlled data and
information, only U.S. citizens, lawful permanent residents (green
cards), or other protected individuals (i.e., persons designated as
an asylee, refugee, or a temporary resident under amnesty
provisions) may apply.
What We Can Offer
- The annual salary range for this position is $99,700 -
$109,660.
Benefits
At the
University of Colorado Boulder , we are
committed to supporting the holistic health and well-being of our
employees. Our comprehensive
benefits package includes medical,
dental, and retirement plans; generous paid time off; tuition
assistance for you and your dependents; and an ECO Pass for local
transit. As one of Boulder County’s largest employers, CU Boulder
offers an inspiring academic community and access to world-class
outdoor recreation. In fact, CU Boulder has been named one of
Forbes' America's Best
Large Employers , ranking #4 among large employers in Colorado
and #28 among universities nationwide. Explore additional perks and
programs through the
CU Advantage program.
Be Statements
Be authentic. Be pioneering. Be Boulder.
What We Require
- Bachelor’s degree in cybersecurity, computer science,
information technology, engineering, or a related field, or an
equivalent combination of education, technical training,
certifications, and relevant professional experience.
- At least 3 years of progressively responsible experience in
cybersecurity operations, incident response, detection engineering,
security monitoring, systems or network administration, digital
forensics, or a closely related technical area.
- Demonstrated experience investigating cybersecurity events
using endpoint, network, email, identity, application, cloud, or
SIEM telemetry.
- Demonstrated experience operating or improving a SIEM, EDR/XDR,
network-monitoring, email security, or comparable security
capability.
Due to the requirement to access export-controlled data and
information, only U.S. citizens, lawful permanent residents (green
cards), or other protected individuals (i.e., persons designated as
an asylee, refugee, or a temporary resident under amnesty
provisions) may apply
What You Will Need
Knowledge
- Knowledge of cybersecurity and privacy principles.
- Knowledge of incident-response, incident-handling, and
post-incident review methodologies.
- Knowledge of networking fundamentals, including TCP/IP, DNS,
routing, network segmentation, firewalls, and common network
telemetry.
- Knowledge of Windows, Linux, and macOS security and logging
concepts.
- Knowledge of authentication, identity, access, endpoint, email,
cloud, and application telemetry relevant to security
investigations.
- Knowledge of SIEM, EDR/XDR, network security monitoring, and
security automation concepts.
- Knowledge of detection-development, testing, tuning,
documentation, and lifecycle-management practices.
Skills
- Skill in correlating data across endpoint, network, identity,
email, cloud, and application sources.
- Skill in designing, documenting, testing, and tuning detections
and response workflows.
- Skill in preparing technical reports, executive summaries,
briefings, procedures, runbooks, and playbooks.
- Skill in scripting, querying, workflow automation, or API
integration using languages and tools such as Python, PowerShell,
Bash, regular expressions, structured query languages, or
comparable technologies.
Abilities
- Ability to communicate complex information in a clear,
accurate, and well-organized manner through verbal, written, and
visual means.
- Ability to collaborate effectively with security personnel,
central and distributed IT providers, system owners, university
leadership, and authorized external parties.
- Ability to translate technical findings into appropriate
corrective actions and sustainable control improvements.
- Ability to balance investigative thoroughness, operational
urgency, service continuity, privacy, and institutional risk.
- Ability to work independently, manage competing priorities, and
exercise good judgment when handling sensitive information.
- Ability to mentor colleagues and student employees when
assigned.
- Ability to learn unfamiliar technologies and adapt monitoring
and response practices as the university’s environment
changes.
What We Would Like You to Have
- 6 or more years of progressively responsible experience in
cybersecurity operations, incident response, detection engineering,
digital forensics, or security-platform engineering.
- Experience administering, engineering, or serving as a
technical owner for a SIEM or large-scale security-monitoring
service.
- Experience developing detections, correlation logic,
dashboards, parsing rules, enrichment, or automated-response
workflows.
- Experience with endpoint, network, email, identity, cloud, and
application-security telemetry.
- Experience scripting or automating security workflows using
Python, PowerShell, Bash, APIs, or comparable technologies.
- Experience monitoring or investigating network traffic and
security-device telemetry.
- Experience developing and documenting processes, playbooks,
runbooks, technical standards, or architecture diagrams.
- Experience collaborating across decentralized technology
environments or multiple organizational units.
- Experience in higher education, research institutions,
healthcare, government, or another large decentralized
environment.
- Experience documenting technical findings, procedures, or
recommendations for technical and nontechnical audiences.
- Relevant training or certification in incident response,
digital forensics, network security monitoring, SIEM engineering,
cloud security, or related disciplines. Examples may include GIAC,
CISSP, Security+, CySA+, SC-200, vendor-specific technical
credentials, or equivalent applied training.
Special Instructions
To apply, please submit the following materials:
1. A current resume.
2. A cover letter that specifically tells us how your background
and experience align with the requirements, qualifications, and
responsibilities of the position.
We may request references at a later time.
Please apply by
November 3, 2026 for consideration.
Note: Application materials will not be accepted via email. For
consideration, please apply through
CU Boulder Jobs.
In compliance with the Colorado Job Application Fairness Act, in
any materials you submit, you may redact or remove age-identifying
information such as age, date of birth, or dates of school
attendance or graduation. You will not be penalized for redacting
or removing this information.
Posting Contact Information
Posting Contact Name: Boulder Campus Human Resources
Posting Contact Email: Recruiting@colorado.edu
