Regulated SaaS Security Operations Perform day-to-day security operations and security engineering for the designated SaaS product and its supporting AWS environment. Execute security controls and operating procedures that preserve the confidentiality, integrity, and availability of the product and its data. Apply FedRAMP, NIST SP 800-53, the CJIS Security Policy, and Granicus security requirements in daily operational and technical activities. Complete assigned continuous monitoring, control testing, audit evidence, corrective action, and authorization maintenance activities in partnership with Governance, Risk, and Compliance, Product, Cloud Engineering, Site Reliability Engineering, and system owners. Identify control gaps, configuration deviations, and emerging technical risk; resolve issues within assigned authority and promptly escalate material concerns.
Perform day-to-day security operations and security engineering for the designated SaaS product and its supporting AWS environment.
Execute security controls and operating procedures that preserve the confidentiality, integrity, and availability of the product and its data.
Apply FedRAMP, NIST SP 800-53, the CJIS Security Policy, and Granicus security requirements in daily operational and technical activities.
Complete assigned continuous monitoring, control testing, audit evidence, corrective action, and authorization maintenance activities in partnership with Governance, Risk, and Compliance, Product, Cloud Engineering, Site Reliability Engineering, and system owners.
Identify control gaps, configuration deviations, and emerging technical risk; resolve issues within assigned authority and promptly escalate material concerns.
Security Platform and Control Operations Operate and maintain endpoint detection and response, centralized security logging and analytics, vulnerability scanning and management, and related cloud security capabilities supporting the product. Verify that in-scope assets are inventoried and monitored, security telemetry is collected and retained, agents and sensors remain healthy, and coverage gaps are corrected. Onboard and maintain security log sources, including parsing, normalization, enrichment, alert routing, retention, access, and data quality. Execute vulnerability scans, validate findings, prioritize risk using exploitability and asset context, coordinate remediation, track exceptions, and verify corrective actions. Build and maintain dashboards and operational reporting for asset coverage, control health, vulnerability exposure, alert trends, response performance, compliance posture, and residual risk. Maintain integrations between security capabilities and cloud, engineering, service management, and collaboration systems to improve data quality, response speed, and operational consistency.
Operate and maintain endpoint detection and response, centralized security logging and analytics, vulnerability scanning and management, and related cloud security capabilities supporting the product.
Verify that in-scope assets are inventoried and monitored, security telemetry is collected and retained, agents and sensors remain healthy, and coverage gaps are corrected.
Onboard and maintain security log sources, including parsing, normalization, enrichment, alert routing, retention, access, and data quality.
Execute vulnerability scans, validate findings, prioritize risk using exploitability and asset context, coordinate remediation, track exceptions, and verify corrective actions.
Build and maintain dashboards and operational reporting for asset coverage, control health, vulnerability exposure, alert trends, response performance, compliance posture, and residual risk.
Maintain integrations between security capabilities and cloud, engineering, service management, and collaboration systems to improve data quality, response speed, and operational consistency.
Monitoring, Detection, Investigation, and Incident Response Monitor security alerts and telemetry, triage events, manage cases, and ensure assigned work is handled consistently and within established response expectations. Investigate identity, endpoint, network, application, and cloud activity; correlate evidence to determine event scope, impact, root cause, and required action. Develop, test, and tune detections, correlation logic, and investigative queries for threats relevant to the product environment while reducing false positives. Perform or support incident response activities including scoping, evidence preservation, containment, eradication, recovery, root-cause analysis, and corrective action tracking. Execute incident response playbooks, escalation paths, notification procedures, exercises, and post-incident reviews suitable for FedRAMP- and CJIS-regulated operations. Maintain complete, accurate, and auditable investigation records, incident timelines, evidence, decisions, and required reports; participate in after-hours response when required.
Monitor security alerts and telemetry, triage events, manage cases, and ensure assigned work is handled consistently and within established response expectations.
Investigate identity, endpoint, network, application, and cloud activity; correlate evidence to determine event scope, impact, root cause, and required action.
Develop, test, and tune detections, correlation logic, and investigative queries for threats relevant to the product environment while reducing false positives.
Perform or support incident response activities including scoping, evidence preservation, containment, eradication, recovery, root-cause analysis, and corrective action tracking.
Execute incident response playbooks, escalation paths, notification procedures, exercises, and post-incident reviews suitable for FedRAMP- and CJIS-regulated operations.
Maintain complete, accurate, and auditable investigation records, incident timelines, evidence, decisions, and required reports; participate in after-hours response when required.
Operational Readiness and Team Collaboration Work closely with the Cybersecurity Operations Lead and the other Cybersecurity Operations Engineer to provide dependable monitoring, investigation, and incident response coverage. Follow and continuously improve runbooks, operating procedures, quality standards, service metrics, shift handoffs, and escalation practices. Maintain cross-training and backup capability for the team's core responsibilities, take ownership of assigned work, and support teammates during periods of elevated demand. Escalate complex, high-severity, or time-sensitive issues promptly and provide clear technical context, evidence, impact analysis, and recommended actions. Contribute to a culture of technical excellence, sound judgment, collaboration, accountability, knowledge sharing, and continuous improvement.
Work closely with the Cybersecurity Operations Lead and the other Cybersecurity Operations Engineer to provide dependable monitoring, investigation, and incident response coverage.
Follow and continuously improve runbooks, operating procedures, quality standards, service metrics, shift handoffs, and escalation practices.
Maintain cross-training and backup capability for the team's core responsibilities, take ownership of assigned work, and support teammates during periods of elevated demand.
Escalate complex, high-severity, or time-sensitive issues promptly and provide clear technical context, evidence, impact analysis, and recommended actions.
Contribute to a culture of technical excellence, sound judgment, collaboration, accountability, knowledge sharing, and continuous improvement.
Data Protection Program Operations Execute assigned operational activities for the Granicus enterprise data protection program under the direction of the Cybersecurity Operations Lead. Support controls for data discovery, classification, handling, access, encryption, monitoring, retention, and secure disposal across relevant environments. Monitor, triage, and investigate suspected data leakage, misuse, or policy violations in coordination with incident response, Privacy, Legal, and business processes. Maintain data protection workflows, evidence, metrics, dashboards, exception records, and remediation tracking that demonstrate control coverage and effectiveness. Partner with Privacy, Legal, Information Technology, Product, Engineering, and business stakeholders to implement protective controls, manage exceptions, and reduce data risk.
Execute assigned operational activities for the Granicus enterprise data protection program under the direction of the Cybersecurity Operations Lead.
Support controls for data discovery, classification, handling, access, encryption, monitoring, retention, and secure disposal across relevant environments.
Monitor, triage, and investigate suspected data leakage, misuse, or policy violations in coordination with incident response, Privacy, Legal, and business processes.
Maintain data protection workflows, evidence, metrics, dashboards, exception records, and remediation tracking that demonstrate control coverage and effectiveness.
Partner with Privacy, Legal, Information Technology, Product, Engineering, and business stakeholders to implement protective controls, manage exceptions, and reduce data risk.
AI, Automation, and Continuous Improvement Use approved AI-assisted analysis and automation throughout monitoring, investigations, vulnerability management, data protection, compliance evidence, reporting, and engineering workflows. Automate repetitive activities such as alert enrichment, case creation, evidence collection, asset reconciliation, vulnerability prioritization, notification, and status reporting. Validate AI-generated insights and apply human-in-the-loop safeguards so sensitive data is handled in accordance with security, privacy, customer, and regulatory requirements. Use scripting, APIs, query languages, and workflow orchestration to improve the speed, consistency, scalability, and auditability of security processes. Propose, test, document, and measure improvements to detections, tooling, workflows, and controls based on operational outcomes, reliability, and controlled risk.
Use approved AI-assisted analysis and automation throughout monitoring, investigations, vulnerability management, data protection, compliance evidence, reporting, and engineering workflows.
Automate repetitive activities such as alert enrichment, case creation, evidence collection, asset reconciliation, vulnerability prioritization, notification, and status reporting.
Validate AI-generated insights and apply human-in-the-loop safeguards so sensitive data is handled in accordance with security, privacy, customer, and regulatory requirements.
Use scripting, APIs, query languages, and workflow orchestration to improve the speed, consistency, scalability, and auditability of security processes.
Propose, test, document, and measure improvements to detections, tooling, workflows, and controls based on operational outcomes, reliability, and controlled risk.
Cross-Functional Collaboration and Cybersecurity Projects Partner with Product, Engineering, Cloud, Compliance, Privacy, and business teams supporting the designated SaaS product and data protection program. Provide practical security input for architecture decisions, platform changes, releases, remediation plans, risk decisions, and customer assurance activities. Communicate findings, incident status, priorities, tradeoffs, and program performance clearly to technical and non-technical stakeholders. Support other cybersecurity projects and operational activities as assigned by the Cybersecurity Operations Lead or Senior Director, Global Cyber Defense.
Partner with Product, Engineering, Cloud, Compliance, Privacy, and business teams supporting the designated SaaS product and data protection program.
Provide practical security input for architecture decisions, platform changes, releases, remediation plans, risk decisions, and customer assurance activities.
Communicate findings, incident status, priorities, tradeoffs, and program performance clearly to technical and non-technical stakeholders.
Support other cybersecurity projects and operational activities as assigned by the Cybersecurity Operations Lead or Senior Director, Global Cyber Defense.
