{"id":4151301,"url":"https://alion.io/job/independence-pet-group-information-security-engineer-principal","title":"Information Security Engineer - Principal","company":{"id":2952795,"name":"Independence Pet Group","domain":"independencepetgroup.com","url":"https://alion.io/company/independencepetgroup","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":99,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":17,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":187899,"max":234873,"currency":"USD","period":"year","gross":null,"usd_annual":234873},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-11-11T00:00:00Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-12T09:21:53Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Established in 2021,Independence Pet Holdings is a corporate holding company that manages a diverse and broad portfolio of modern pet health brands and services, including insurance, pet education, lost recovery services, and more throughout North America.\nWe believe pet insurance is more than a financial product and build solutions to simplify the pet parenting journey and help improve the well-being of pets. As a leading authority in the pet category, we operate with a full stack of resources, capital, and services to support pet parents. Our multi-brand and omni-channel approach include our own insurance carrier, insurance brands and partner brands.\nPosition Summary:\nWe are seeking an experienced Principal Security Operations Lead to join the North America Information Security team, reporting directly to the Director of Security Operations. This is a hands-on technical role focused on incident response, threat intelligence, and forensic investigations across cloud and legacy environments.\nThe successful candidate will help support a unified enterprise security operations model, including the continued implementation of SIEM and detection tools across environments, advanced threat intelligence, and automated response processes. The role requires strong Microsoft Azure and Microsoft 365 security experience, multi-layer investigations, phishing response, clear communication, and the ability to work across Security Engineering, Security Operations, GRC, Infrastructure, Cloud, DevOps, application, and business teams.\nThis role is expected to act as the key contact for technical investigations, drive remediation, produce clear documentation and evidence, and provide quality review and escalation support for repeatable work performed by offshore or managed-service partners.\nWhat You Will Do:\n\nThreat Intelligence and Adversary Analysis\nLead the collection, analysis, and operationalization of cyber threat intelligence from internal telemetry, commercial intelligence providers, open-source intelligence (OSINT), and industry sharing groups.\nAnalyze adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK and translate intelligence into actionable detections, monitoring requirements, investigations, and security control improvements.\nDevelop intelligence reports, threat briefs, and executive summaries that communicate emerging threats, risk trends, adversary activity, and potential business impacts.\nTrack industry-specific threats affecting insurance, financial services, healthcare, cloud platforms, and software supply chains.\nPartner with Security Engineering and Security Architecture teams to incorporate threat intelligence into detection logic, control design, policy updates, and incident response processes.\nSecurity Monitoring and Incident Investigation\nLead advanced investigations involving suspicious activity, account compromise, insider threats, ransomware, malware infections, cloud attacks, phishing campaigns, business email compromise, data exfiltration, and unauthorized access attempts.\nPerform deep analysis of security alerts generated by SIEM, XDR, EDR, email security, identity platforms, cloud security\nsolutions, and network security tools.\nCorrelate logs, events, endpoint telemetry, cloud activity, authentication records, and threat intelligence to determine attack\nscope, impact, and root cause.\nServe as an escalation point for complex investigations requiring advanced analytical skills, cross platform analysis, or forensic validation.\nDigital Forensics and Evidence Preservation\nConduct forensic investigations involving endpoints, servers, Microsoft 365, Azure, identity platforms, email systems, cloud workloads, and hybrid environments.\nAcquire, preserve, analyze, and document digital evidence while maintaining chain-of custody requirements and evidentiary integrity.\nPerform memory analysis, artifact collection, timeline reconstruction, log validation, malware triage, and root-cause investigations.\nDevelop forensic findings reports that clearly document attack timelines, affected assets, responsible threat activity, business impact, and recommended remediation actions.\nSupport legal, compliance, audit, and regulatory response activities requiring technical investigative evidence and forensic documentation.\nThreat Hunting and Detection Engineering\nDesign and execute proactive threat-hunting activities to identify malicious activity that may evade traditional detection methods.\nHypothesis driven hunting across Azure, Microsoft 365, Sentinel, Microsoft XDR, Defender for Endpoint, Entra ID, network telemetry, and cloud application logs.\nDevelop and improve advanced detection logic, correlation rules, behavioral analytics, watchlists, and hunting queries based onemerging threats and intelligence findings.\nIdentify detection gaps and recommend new monitoring capabilities to improve visibility across cloud, endpoint, identity, and network environments.\n\n Incident Response and Cyber Crisis Support\nServe as a lead technical responder during cybersecurity incidents, coordinating containment, eradication, recovery, and post-incident analysis activities.\nGuide incident response efforts during ransomware events, credential compromise investigations, data breaches, insider threat cases, cloud security incidents, and advanced persistent threat (APT) activity.\nFacilitate technical war rooms and provide timely status updates to leadership, technology teams, legal stakeholders, and\nexecutive management.\nEnsure incidents are documented thoroughly with clear investigative findings, response actions, lessons learned, and\nremediation recommendations.\nParticipate in incident response exercises, tabletop simulations, and cyber resilience testing to improve organizational\nreadiness.\nSecurity Operations Platform Optimization\nSupport and continuously improve Microsoft Sentinel, Microsoft XDR, Defender for Endpoint, Defender for Cloud, Entra ID,\nCrowdstrike, and related detection and investigation technologies.\nCreate dashboards, automated workflows, enrichment processes, and case management integrations that improve investigation speed and analyst effectiveness.\nTune detections, reduce false positives, standardize triage processes, and help mature security operations capabilities across\nthe enterprise.\nDevelop metrics and reporting that measure detection performance, investigation quality, containment effectiveness, Mean Time to Acknowledge (MTTA), and Mean Time to Respond (MTTR).\nSenior Technical Expertise and Security Operations Maturity\nAct as a senior analyst and subject matter expert for threat intelligence, forensic investigations, incident response, and threat hunting activities.\nProvide quality review, mentoring, and escalation support for analysts, offshore resources, managed security service providers, and security operations partners.\nDevelop investigation playbooks, forensic procedures, threat-hunting methodologies, standard operating procedures, and analyst training materials.\nMaintain professional documentation including incident reports, forensic reports, threat profiles, attack-path analysis, runbooks, diagrams, and executive briefings.\nStay current on emerging threats, attack techniques, cloud security risks, adversary campaigns, and cybersecurity best practices to continuously strengthen organizational defense capabilities.\nWhat You Will Bring:\nBachelor's degree in Cybersecurity, Computer Science, Information Systems, Digital Forensics, Information Assurance, or a related discipline; equivalent professional experience may be considered.\nMinimum 10 years of progressive experience in Security Operations, Threat Intelligence, Incident Response, Threat Hunting, Digital Forensics, or Cyber Defense roles within enterprise environments.\nDemonstrated experience conducting complex investigations involving ransomware, business email compromise (BEC), insider threats, account compromise, malware infections, cloud security incidents, advanced persistent threats (APT), and data exfiltration events.\nAdvanced knowledge of cyber threat intelligence methodologies, including the collection, enrichment, analysis, and operationalization of intelligence from commercial providers, industry sharing groups, open-source intelligence (OSINT), and internal telemetry sources.\nStrong understanding of adversary tactics, techniques, and procedures (TTPs) and the ability to leverage frameworks such MITRE ATT&CK, Cyber Kill Chain, Diamon Model, and ATT&CK Navigator to support investigations, threat hunting, and detection engineering activities.\nProven experience converting threat intelligence into actionable security outcomes, including new detections, hunting hypotheses, correlation rules, watchlists, automated response actions, and security control enhancements.\nDeep experience performing digital forensic investigations across endpoints, servers, Microsoft 365, Azure, cloud workloads, email platforms, identity systems, and hybrid environments.\nHands-on expertise in forensic evidence acquisition, preservation, chain-of custody management, timeline construction, artifact analysis, memory analysis, malware triage, and root-cause determination.\nStrong analytical skills with experience correlating endpoint telemetry, cloud logs, authentication records, network activity, SIEM data,\nthreat intelligence, and forensic artifacts to identify malicious activity and determine business impact.\nExtensive experience conducting proactive threat hunting across Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, CrowdStrike, Microsoft 365, Entra ID, Azure, endpoint telemetry, cloud platforms, network security data sources.\nExpertise developing advanced detection content, including SIEM analytics rules, behavioral detections, KQL hunting queries, automation workflows, enrichment logic, and incident investigation playbooks.\nHands-on experience with Microsoft security technologies including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, Defender for Identity, Microsoft Purview, Entra ID, and related security monitoring platforms.\nStrong understanding of log analysis, packet analysis, endpoint investigations, cloud security monitoring, attack-path analysis, and forensic validation techniques.\nExperience leading technical response activities during cybersecurity incidents, including containment, eradication, recovery, evidence preservation, executive communications, and post-incident reviews.\nExperience producing high-quality forensic reports, threat intelligence assessments, attack narratives, executive briefings, and technical documentation suitable for legal, audit, compliance, and leadership audiences.\nKnowledge of regulatory and compliance requirements impacting security investigations, including evidence handling, audit readiness, data protection obligations, breach response, and regulatory reporting requirements.\nStrong understanding of security frameworks and best practices including NIST Cybersecurity Framework, NIST 800-61, NIST800-86, NIST 800-53, MITRE ATT&CK, CIS Controls, ISO 27001, and ISO 27035.\nExcellent written and verbal communication skills with the ability to clearly communicate technical investigative findings, threat intelligence assessments, and risk impacts to both technical and non-technical stakeholders.\nProven ability to act as a senior technical escalation resource, mentor junior analysts, and provide quality oversight for offshore teams, managed security service providers (MSSPs), and security operations partners.\nStrong attention to detail, intellectual curiosity, investigative mindset, and the ability to independently manage high-priority investigations while balancing multiple concurrent security events.\nCompensation:\nChicago Base pay range: $187,899 - $234,873 per year\nNationwide Base pay range: $170,871 - $213,521 per year\nThis is the range we reasonably expect to pay at hire. Placement within the range de...","description_format":"text","description_chars":13464,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave","Pet friendly","Retirement plans","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Property & Casualty Insurance","Information Security","InsurTech"],"lifecycle":[{"event":"open","at":"2026-11-12T09:21:53Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":17,"reasons":["conf:1","win:early"],"computed_at":"2026-11-12T10:38:37Z"},"pay":{"stated_usd_annual":234873,"is_top_pay":true},"html_url":"https://alion.io/job/independence-pet-group-information-security-engineer-principal","json_url":"https://alion.io/job/independence-pet-group-information-security-engineer-principal.json","meta":{"generated_at":"2026-11-12T13:18:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27629,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2952795},"rest":"https://alion.io/mcp/rest/get_company?id=2952795"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Findependence-pet-group-information-security-engineer-principal"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Findependence-pet-group-information-security-engineer-principal"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Findependence-pet-group-information-security-engineer-principal"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/independence-pet-group-information-security-engineer-principal\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Findependence-pet-group-information-security-engineer-principal"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4151301}},{"tool":"search_jobs","arguments":{"company":"independencepetgroup.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4151301},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}