Security Operations Center Manager Jobs in Riverside, CA

The Senior Information Security Analyst plays a hands-on role in helping protect the organization from cybersecurity threats. In this role, you’ll help identify, investigate, and respond to security incidents, work with team members to prioritize issues, communicate findings clearly, and support efforts to reduce risk as incidents arise.

Threat Monitoring, Alert Triage & Investigation: 

• Monitor and triage alerts across security platforms, validating true security incidents and eliminating false positives. Investigate confirmed threats to determine scope, severity, and business impact using log analysis, endpoint telemetry, and threat context. Prioritize and escalate security incidents in accordance with established incident response procedures.

Detection Engineering & Tuning:

• Develop and tune security detections to improve accuracy, reduce alert noise, and increase visibility into malicious activity. Apply MITRE ATT&CK techniques and threat intelligence to enhance detection logic and investigative workflows. Identify detection gaps and recommend improvements based on investigative findings and emerging threats.

Scripting, Automation & Tooling:

• Develop scripts and automation to streamline alert triage, investigations, and response activities. Automate repetitive operational tasks to improve consistency, efficiency, and response times. Support integration and optimization of security tools through scripting and data transformation.

Security Project Contribution: 

• Contribute to security operations projects that improve program maturity, detection capabilities, and operational resilience. Collaborate with IT and engineering teams to implement and enhance security controls and workflows. Provide operational and investigative input to support successful deployment of security initiatives.

Incident Response & Reporting:

• Provide hands-on support during security incidents, including containment, remediation guidance, and recovery activities. Produce clear, accurate incident reports detailing findings, root cause, and corrective actions. Participate in post-incident reviews to identify lessons learned and recommend preventive improvements.

Additional responsibilities as assigned:

• Support ad hoc security operations tasks, audits, and operational readiness activities. Provide backup coverage and operational support during incidents or peak workload periods. Participate in training, documentation, and continuous improvement initiatives.

Required:

• 5+ years of hands-on experience in information security, security operations, incident response, or threat detection roles.
• Bachelor’s degree in a security-related discipline or equivalent practical experience supported by formal security training or industry-recognized certifications.
• Demonstrated experience performing alert triage, threat investigation, and incident response activities using enterprise security tools (e.g., SIEM, EDR, email security platforms).
• Working knowledge of security operations processes, including incident lifecycle management, escalation procedures, and stakeholder communication.

Preferred:

• Experience working in a Security Operations Center (SOC) or similar 24x7/enterprise monitoring environment.
• One or more industry-recognized security certifications such as CompTIA CySA+, GCIH, GCED, OSDA, CEH, or equivalent.
• Experience with detection engineering, threat hunting, or tuning security controls to reduce false positives and improve detection fidelity.
• Hands-on scripting or automation experience (e.g., PowerShell, Python, Bash, Vibe coding) used to support investigations or operational efficiency.
• Familiarity with the MITRE ATT&CK framework and applying adversary TTPs to investigations or detection logic.
• Experience contributing to security tools deployments, process improvements, or cross-functional security initiatives.

Required:

• Working knowledge of security operations concepts, including alert triage, incident investigation, escalation, and response workflows.
• Hands-on experience using enterprise security tools such as SIEM, EDR, and email security platforms for detection and investigation activities.
• Strong analytical and problem-solving skills, with the ability to assess security alerts, identify root cause, and recommend appropriate mitigation actions.
• Ability to clearly document and communicate security findings, risks, and remediation guidance to both technical and non-technical audiences.
• Foundational experience or working capability with scripting or automation tools (e.g., PowerShell, Python, or Bash) to support security operations.

Preferred:

• Working knowledge of the MITRE ATT&CK framework and experience applying adversary tactics, techniques, and procedures (TTPs) to detection and investigation activities.
• Experience tuning detections or detection logic within SIEM or EDR platforms to reduce false positives and improve detection fidelity.
• Strong hands-on experience with endpoint detection and response (EDR) tools for investigation, containment, and remediation.
• Experience performing email security analysis, including phishing investigation, header analysis, and email-based threat identification.
• Demonstrated experience developing scripts or automation workflows to improve operational efficiency and response consistency.
• Ability to confidently present security risks, incident findings, and mitigation strategies to technical teams and senior leadership.