Incident Response Analyst - Agentic SOC

Job description

The application window is expected to close on: 11/05/2026Meet the TeamSplunk Global Security is Customer Zero for Splunk’s security products: our 24/7 global SOC runs Splunk’s newest AI agents against real production threats before most of the world sees those agents, and turns what we learn into product changes that reach Splunk’s customers. We are now making agent-assisted investigation the way our SOC works every day, with AI agents handling repetitive triage, enrichment, and summarization so analysts can focus on judgment calls and deeper investigation. You will join the team defining how analysts and agents work together in a production SOC, setting the patterns other teams adopt. Splunk, a Cisco company, is building a safer and more resilient digital world, and offers a high-performance environment where people at every level are empowered to make an impact and advance their careers! Your ImpactSplit your time between investigating incidents in our global 24/7 SOC and building, evaluating, and hardening the agentic tooling behind those investigations, helping decide how far agents can act on their own, when a human must approve, and how we prove the agents got it right. Triage, investigate, and respond to alerts across Splunk’s product and enterprise environments, using agentic triage and enrichment as a first pass and validating every verdict before acting, then scope incidents with Splunk Enterprise Security (Mission Control), SPL, and EDR, identity, and cloud tooling to collect evidence, document findings, and drive containment and critical issue. Partner with Detection Engineering to tune detections, reduce false positives, and close coverage or data-quality gaps surfaced by analysts or agents. Build and maintain agent skills, prompts, and integrations (MCP servers, SOAR playbooks, enrichment lookups) through GitLab merge requests and code review, turning every recurring manual procedure into a tested, documented agent workflow and keeping runbooks current, so you and your peers spend less time on toil and more on deeper investigation and real incident response. Evaluate and harden that tooling with test cases from real alerts, accuracy and false-verdict tracking, approval gates, autonomy limits, audit trails, and defenses against prompt injection, sensitive-data exposure, and over-privileged credentials, while running pre-release Splunk security AI as Customer Zero and delivering structured findings to the Enterprise Security, SOAR, and AI product teams, so what you learn becomes product changes for Splunk’s customers. Minimum Qualifications4+ years of experience in security operations, incident response, or security monitoring, including alert triage and investigation with SIEM, EDR, identity, and cloud tooling, plus knowledge of incident response process and common attacker techniques. Experience with TCP/IP, DNS, HTTP, authentication flows, endpoint behavior, and cloud Experience writing and troubleshooting security searches in SPL, KQL, SQL, or a similar query language. Experience reading and modifying Python or Bash automation, YAML/JSON configuration, and playbooks using Git workflows (branches, merge requests, code review). Experience using LLM-based or agentic tools, verifying their output against raw evidence. Preferred QualificationsExperience with Splunk Enterprise Security 8 (Mission Control), Splunk SOAR, or Splunk AI Assistant. Experience building agent tools or integrations: LLM tool calling, Model Context Protocol (MCP) servers, or retrieval-augmented generation (RAG) over runbooks and case history. Experience designing evaluations for LLM or agent output (golden datasets, scoring rubrics, regression tests) and running them in GitLab CI/CD pipelines with automated testing and approval gates. Knowledge of AI security risks, including the OWASP Top 10 for LLM Applications, prompt injection, and model data-handling controls. Clear written communication: investigation notes, runbooks, and explanations of when and why an agent’s conclusion was wrong. Shift Schedule:This role works a four-day schedule Wednesday - Saturday from 12:00 p.m to 10:00 p.m Central Time Sunday through Wednesday, from 12:00 p.m. to 10:00 p.m. Central Time Why Cisco? At Cisco, we’re revolutionizing how data and infrastructure connect and protect organizations in the AI era – and beyond. We’ve been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint. Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you’ll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere. We are Cisco, and our power starts with you. Message to applicants applying to work in the U.S. and/or Canada: The starting salary range posted for this position is $116,600.00 to $147,900.00 and reflects the projected salary range for new hires in this position in U.S. and/or Canada locations, not including incentive compensation*, equity, or benefits. Individual pay is determined by the candidate's hiring location, market conditions, job-related skillset, experience, qualifications, education, certifications, and/or training. The full salary range for certain locations is listed below. For locations not listed below, the recruiter can share more details about compensation for the role in your location during the hiring process. U.S. employees are offered benefits, subject to Cisco’s plan eligibility rules, which include medical, dental and vision insurance, a 401(k) plan with a Cisco matching contribution, paid parental leave, short and long-term disability coverage, and basic life insurance. Please see the Cisco careers site to discover more benefits and perks.  Employees may be eligible to receive grants of Cisco restricted stock units, which vest following continued employment with Cisco for defined periods of time. U.S. employees are eligible for paid time away as described below, subject to Cisco’s policies: 10 paid holidays per full calendar year, plus 1 floating holiday for non-exempt employees 1 paid day off for employee’s birthday, paid year-end holiday shutdown, and 4 paid days off for personal wellness determined by Cisco Non-exempt employees** receive 16 days of paid vacation time per full calendar year, accrued at rate of 4.92 hours per pay period for full-time employees Exempt employees participate in Cisco’s flexible vacation time off program, which has no defined limit on how much vacation time eligible employees may use (subject to availability and some business limitations) 80 hours of sick time off provided on hire date and each January 1st thereafter, and up to 80 hours of unused sick time carried forward from one calendar year to the next Additional paid time away may be requested to deal with critical or emergency issues for family members Optional 10 paid days per full calendar year to volunteer For non-sales roles, employees are also eligible to earn annual bonuses subject to Cisco’s policies. Employees on sales plans earn performance-based incentive pay on top of their base salary, which is split between quota and non-quota components, subject to the applicable Cisco plan. For quota-based incentive pay, Cisco typically pays as follows: .75% of incentive target for each 1% of revenue attainment up to 50% of quota; 1.5% of incentive target for each 1% of attainment between 50% and 75%; 1% of incentive target for each 1% of attainment between 75% and 100%; and Once performance exceeds 100% attainment, incentive rates are at or above 1% for each 1% of attainment with no ca