Open Indianapolis Cybersecurity jobs

Summary

Principal architect setting cloud security strategy for a large health insurer across AWS, Azure and GCP: reference architectures, policies, guardrails, threat modeling and secure patterns for IAM, encryption, network security and zero trust. Champions DevSecOps and policy-as-code, advises leadership on cloud risk, and authors security position papers with the CISO office. Hybrid, with no current or future visa sponsorship.

Summary

Information security advisor leading enterprise PCI DSS compliance at a large health insurer: control interpretation, scope validation, evidence review, remediation tracking and readiness for QSA, ROC and SAQ assessments, plus third-party service provider reviews. Also supports HIPAA, HITRUST, SOC 2 and NIST audits; an active or prior PCI ISA or QSA certification is preferred. Hybrid, with 1-2 office days a week near a company location.

Summary

Technical lead for enterprise identity and authentication services at an agriculture company, owning the architecture and operation of Active Directory, Entra ID hybrid identity, and enterprise single sign-on and federation (SAML, OAuth, OIDC, Kerberos). The work spans Conditional Access and MFA, application onboarding to SSO, passwordless and Zero Trust modernization, and incident response for identity outages, while mentoring IAM engineers and administrators.

Summary

Technical privacy specialist in Cigna's Enterprise Privacy Office, reporting to the Chief Privacy Counsel and owning the platforms that scan and govern cookies, pixels, tags, consent behavior and data transfers across websites and mobile apps. Builds data maps, analyzes logs and findings for control gaps, and supports privacy incident response by determining affected systems, data and individuals. Requires 5+ years in privacy, security, web or application-security engineering, with no software development duties.

Summary

Hands-on network security engineer placed with a client in a regulated environment, designing, implementing, and troubleshooting Palo Alto firewalls and F5 load balancing and application security modules. The work translates security and compliance policies into firewall rule sets and controls across multiple concurrent projects.

Summary

Entry-level governance, risk and compliance analyst on a law firm's Information Security team, maintaining the security risk register, supporting IT risk assessments and third-party risk reviews, and helping run the ISO 27001/27701 ISMS and PIMS. Also handles security exceptions, client security questionnaires and RFP content, policy reviews and the security awareness program. Security+ or ISC2 CC is preferred, with interest in CISSP or CISA.

Summary

Security operations seat at a community college: monitors and protects campus computer and network systems, operates and troubleshoots security infrastructure devices such as IDS/IPS, DLP, firewalls and web filtering, and handles trouble tickets and escalations. Entry-level bar of one or more years in IT with experience securing networks, desktops, servers and virtual environments; programming and scripting familiarity is required but there is no development duty. Hiring range stated as $60,000-65,000, reporting to the Director of Information Security.

Summary

Organizational change management and program-support seat inside MISO's cybersecurity function: builds change strategies and communication plans so teams adopt new security processes and technologies, supports third-party risk processes, and handles scheduling, documentation and tracking of plans of action and milestones for security initiatives. The bar is five years of change management and program delivery in cybersecurity or technology environments with a business, communications or IT degree; this is a coordination and communications role, not a technical control-owner role. Onsite, classified under Communications and External Relations; stated range $112,000-$137,000.

Summary

Senior SOC analyst seat combining security monitoring, threat hunting, detection-rule development and tuning, and leading complex incident investigations from detection through containment, remediation and closure. Serves as the escalation point and mentor for other analysts, writes incident reports and executive summaries, and maintains SOC playbooks and runbooks. Requires 5 to 7 years in security operations, investigations or incident response with working knowledge of SIEM, EDR and identity tooling; advanced certifications are preferred but not required.

Summary

Summer internship or co-op on an industrial manufacturer's IT Security Operations team, monitoring the environment, investigating incidents, and helping deploy and operate security tools. Interns also support vulnerability testing and remediation and document security incidents. Open to undergraduates studying cybersecurity, computer science, IT or related fields, with no prior experience required.

Summary

Consulting manager and IAM architect in an accounting firm's cybersecurity practice, defining client identity strategy, roadmaps and reference architectures and leading design and implementation of SSO, MFA, identity governance, provisioning and privileged access across Azure, AWS, GCP and hybrid environments. Also performs IAM risk assessments and threat modeling and supports broader IT risk and compliance engagements, presenting to client executives. Hybrid; the firm does not sponsor work authorization.

Summary

Escalation responder in a professional-services firm's Security Operations Center, triaging security events, following incident playbooks, and leading containment and remediation during incidents. Performs network monitoring and intrusion analysis across IDS/IPS, firewalls, EDR, Azure security and log sources, with Microsoft Sentinel among the required tools, and improves detection rules and playbooks. The role includes an on-call rotation; although titled analyst, the duties describe it as a SOC Engineer.

Summary

Security engineer owning the multi-tenant security stack behind an MSSP's SOC, including SentinelOne, CrowdStrike, Splunk, Cisco Firepower/ASA, Cisco Umbrella, DNSFilter and Avanan. Handles client tool deployment, log-source onboarding, upgrades under change control, detection tuning against MITRE ATT&CK, coverage reviews against CIS and NIST CSF, and PowerShell/Python automation. Serves as engineering escalation for SOC analysts during incidents and joins an after-hours escalation rotation.

Summary

Player-coach SOC manager at a managed security provider, running detection, response and reporting across a multi-tenant client base and leading Tier 1 to 3 analysts plus a security engineer who owns the tooling. Expect to act as incident commander on ransomware, business email compromise and account takeover cases, do hands-on DFIR and purple-team work, author detections at the query level in EDR/SIEM (SentinelOne, CrowdStrike, Splunk), and own SLAs, MTTA/MTTR metrics and client QBRs. Requires 8+ years with 3+ leading a SOC or IR team, CISSP or CISM plus GIAC GCIH, and availability to lead after-hours incidents.

Summary

Hands-on security architect for Salesforce's own Salesforce org, owning sharing and visibility models, Shield encryption, SSO and Connected App/OAuth governance, and Security Center policy and drift detection across a multi-org landscape. Builds Transaction Security Policies in Apex or low-code, reviews Apex and LWC code for vulnerabilities, and wires static analysis into the CI/CD pipeline. Requires 10+ years in the Salesforce ecosystem plus Sharing and Visibility and Identity and Access Management architect certifications.

Summary

A security architecture seat inside the IT organisation of an insurance group, setting the security standards that govern adoption of new technology and defining design requirements for security risk on IT and enterprise projects. A large share of the work is governance rather than engineering: maintaining segregation-of-duties access controls alongside business, audit and application teams, running internal and third-party security assessments with particular emphasis on cloud service providers, writing policy, and building management dashboards that report security risk to senior leadership against SOX, PCI and HIPAA obligations. It is remote but limited to candidates in a US Eastern or Central time zone, and asks for ten or more years of IT experience with at least three as a security architect.

Summary

Tier 2 security operations analyst at a managed security services provider, owning the alerts and tickets that Tier 1 cannot resolve across multiple client environments and driving each to a resolution or to engineering with a recommended action. Day-to-day work is SIEM, EDR, email and cloud alert triage, containment through SentinelOne and account isolation in Entra ID, credential rotation guidance, evidence collection, phishing triage, scheduled threat hunts using SDL queries and CTI indicators, and detection tuning with the senior engineers and purple team to cut false positives. The seat also mentors Tier 1, writes and refines playbooks, and authors the analytical narrative for monthly client reports; it is described as high volume and hands-on with a bar of three or more years in a SOC or incident response.

Summary

A ten-week summer internship inside a law firm's information security department, working under the department director and an assigned mentor on projects that advance the firm's information security initiatives, including cyber security. The work is project support rather than hands-on security operations: data input, data analysis, process documentation, recordkeeping, and participation in internal and external meetings, with strict confidentiality on all client and firm matters. Eligibility is narrow - candidates must be entering their sophomore, junior or senior year in the fall of 2027, be enrolled in a two-to-four-year undergraduate program for college credit, and be available for ten consecutive weeks.

Summary

A summer 2027 internship working inside the cybersecurity operations of a regional grid operator: building small automations, improving detections, analyzing logs, and assisting with threat hunts and incident investigation using the security team's production tooling such as SIEM, EDR and NDR platforms. Interns also look for recurring problems in security operations processes and propose practical fixes, then close the summer with a presentation on their project work and recommendations. The program runs on site in Carmel, Indiana across a fixed June-to-August window, and no visa sponsorship is offered, including OPT and CPT.

Summary

A twelve-month information security co-op that rotates through two to five specialties, among them vulnerability management, application security, cloud security, security operations center work, IT controls compliance, encryption and security policy. The tasks are operational: pre-production vulnerability scanning of servers, databases and network devices, triage of events raised by the incident management tooling, and running code-inspection tools against internally developed applications before release. Current enrollment in a related degree program is required, the commitment is twenty to forty hours a week on weekdays, and the program runs as Spring 2027 and Summer 2027 cohorts with one to two office days a week.

Summary

Supports an insurer's information security program through application security, vulnerability management, security metrics and reporting, and day-to-day operational security activities. The core of the work is identifying, assessing, reporting and tracking security risks and vulnerabilities across enterprise information assets while supporting security governance objectives.

Summary

Senior individual-contributor technical leader in a security integrator's Cisco Center of Excellence, defining technical strategy across Cisco enterprise networking, network security, secure access, segmentation and digital experience. The work is client-facing architecture advisory: leading technical discovery on complex opportunities, advising CISOs, CIOs and network and security leaders on modernization options and multiyear roadmaps, developing reference architectures that connect Cisco capabilities to Splunk, ThousandEyes, identity and cloud services, and building reusable workshops, demonstrations, decision frameworks and lab environments for proofs of concept. The role is positioned on the pre-sales side of a pre-sales-to-delivery handoff and works through expertise and influence rather than direct authority, with commercial account ownership and forecasting held by sales leaders, and it is fully remote anywhere in the continental United States.

Summary

Internship on a consulting firm cybersecurity team, helping clients assess and refine information security posture, technology implementations and regulatory compliance alongside experienced security practitioners. The work is field-based at client sites of varying size and industry from the first day rather than desk-based, and willingness to travel as client or project requirements dictate is a stated requirement. Candidates are expected to know information technology fundamentals including basic network services such as TCP/IP, HTTP, SSH, SMB and DNS and where they sit on the OSI model, routing and switching, Windows and Active Directory or Linux and Unix system administration, and database administration on platforms such as Microsoft SQL, Oracle and Mongo.

Summary

A governance, risk and compliance seat inside a city and county technology agency, reporting to the CISO and running the internal control review program: periodic access reviews, vendor and third-party risk assessments, physical security reviews, and encryption and antivirus reviews. The work tracks the organization against CIS Benchmarks, NIST, CJIS and PCI, manages a vendor risk management program and the risk and compliance register, tracks contractually obligated security deliverables in agency contracts, and monitors remediation of compliance and security findings. It also supports the incident manager with root cause and post-incident documentation, uses ServiceNow for ticket management, and is based on site at the City County Building.

Summary

Hands-on IT lead and first-line manager for a government contractor building an in-house IT function, overseeing Windows Server, Active Directory, networking, virtualization and the M365 environment while supervising IT systems engineers. Owns security controls and audit readiness against NIST 800-53/800-171, FISMA, CMMC and IRS Publication 4812, including POA&Ms, SSP inputs, vulnerability management and SIEM, working with MSSPs and third-party assessors. Also leads the move of services from outsourced providers to internal teams; U.S. citizenship and Public Trust eligibility required.

Summary

A senior identity and access management security role at an IT consulting firm, owning the identity security standard that client environments inherit, including the Conditional Access baseline, tiered admin model, privileged access configuration, and phishing-resistant MFA. The work centers on enforcing MFA across client VPN and application access and blocking legacy authentication, making this a cybersecurity and identity-security position rather than software development. It is client-facing consulting work.

Summary

Senior SOC role (Tier 3 escalation) at MSSP EXOS CYBER, owning confirmed security incidents end to end across client environments through advanced detection, incident response, threat hunting, and host/memory/network forensics (Velociraptor, SentinelOne, Entra ID), while QA-ing escalations, mentoring Tier 1/2 analysts, and partnering with engineering on detection strategy against MITRE ATT&CK. Requires 5+ years (or 2+ years past Tier 2). Indianapolis, IN.

Summary

Defense contractor role installing, configuring, patching and maintaining mission-critical enterprise IT infrastructure, including implementing security controls and supporting integration and configuration management. Supports military exercises with 10-25% travel between Camp Atterbury and the Muscatatuck Training Center. Requires an active DoD Secret clearance, and the opening is pre-award, contingent on a contract win.

Summary

Information assurance and security compliance lead responsible for Assessment and Authorization, Risk Management Framework, FISMA and FISCAM audits, and maintaining Authority to Operate and Authority to Connect for federal systems, including managing RMF artifacts such as SSP and POA&M in eMASS. Supervises IA personnel and coordinates with government auditors and stakeholders within DoD and DIA (JWICS) environments. This is a federal governance and compliance focused cybersecurity leadership role.

Summary

Senior technical and program lead over a DoD Cybersecurity Service Provider (CSSP) engineering team, directing security infrastructure engineering such as IDS/IPS, firewalls, endpoint security, ACAS and SIEM (ArcSight), along with vulnerability and patch management, incident response, and STIG and Zero Trust compliance across classified and unclassified enclaves. Work aligns to DoD, DISA and US Cyber Command requirements. This is a government contract role with multi-site oversight and likely clearance requirements.

Summary

Operations lead for a 24/7/365 DoD cyber operations team, directing continuous monitoring, event analysis, incident response and vulnerability management using SIEM (ArcSight) and IDS/IPS across classified and unclassified enclaves. Serves as senior subject matter expert interfacing with government stakeholders and enforcing DoD, DISA and Zero Trust compliance. This is a government contract security operations leadership role with round-the-clock coverage duties.

Summary

A briefly described cybersecurity technician role at C2IT Consulting covering practical security operations: running security scans and audits, performing risk assessments and information gathering, resolving security issues, managing and implementing security policies and controls, and running phishing training and remediation. The posting gives few specifics on seniority or stack; Indianapolis.