About this role:

Wells Fargo is seeking a Principal Engineer in Technology as part of Cybersecurity. Learn more about the career areas and lines of business at wellsfargojobs.com.

Wells Fargo is seeking a Principal Cybersecurity Engineer – Incident Detection & Response (CIDR) to serve as the senior technical leader responsible for engineering, maturing, and guiding the end‑to‑end Cyber Incident Detection & Response ecosystem. This role will architect and evolve the enterprise’s detection and response capabilities—including SIEM, SOAR, alerting pipelines, threat‑driven detection logic, telemetry engineering, and response workflow automation—to ensure resiliency, consistency, and rapid response across a diverse and highly complex technology environment.

You will partner closely with operations teams, engineering teams, threat intelligence, senior leadership, infrastructure, cloud, identity, and business stakeholders to drive the strategic technical direction of CIDR and ensure alignment with enterprise risk, regulatory expectations, and evolving threat landscapes.

This role requires deep engineering expertise, senior‑level architectural judgment, and the ability to lead highly complex initiatives, influence diverse stakeholders, and deliver enterprise‑scale systems that materially improve Wells Fargo’s defensive posture.

Visa sponsorship is not offered for this role

In this role, you will:

• Act as an advisor to leadership to develop or influence applications, network, information security, database, operating systems, or web technologies for highly complex business and technical needs across multiple groups
• Lead the strategy and resolution of highly complex and unique challenges requiring in-depth evaluation across multiple areas or the enterprise, delivering solutions that are long-term, large-scale and require vision, creativity, innovation, advanced analytical and inductive thinking
• Translate advanced technology experience, an in-depth knowledge of the organizations tactical and strategic business objectives, the enterprise technological environment, the organization structure, and strategic technological opportunities and requirements into technical engineering solutions
• Provide vision, direction and expertise to leadership on implementing innovative and significant business solutions
• Maintain knowledge of industry best practices and new technologies and recommends innovations that enhance operations or provide a competitive advantage to the organization
• Strategically engage with all levels of professionals and managers across the enterprise and serve as an expert advisor to leadership

Technical Strategy & Leadership

• Serve as the senior technical advisor for the CIDR ecosystem, including architecture, engineering, workflow orchestration, automation, and emerging AI‑enabled capabilities.
• Define and maintain the long‑term architectural vision, technical standards, and reference designs for detection and response platforms, ensuring cohesive integration across cloud, endpoint, identity, network, and third‑party environments.
• Translate enterprise risk, threat intelligence, operational data, and regulatory expectations into actionable engineering direction, roadmaps, and platform investments.
• Lead evaluation of emerging tools and industry trends to drive continuous modernization of CIDR capabilities.

Detection Engineering, Platform Architecture & Ecosystem Ownership

• Provide deep technical expertise and engineering leadership across detection architecture, SIEM design, log/telemetry pipelines, correlation logic, enrichment workflows, alert lifecycle management, and SOAR automation.
• Engineer reliable, scalable detection pipelines aligned with MITRE ATT&CK, NIST 800‑61, and other frameworks.
• Lead design and engineering of playbooks, automated workflows, metrics, reporting, and escalation paths into Incident Management and CSIRT.
• Ensure telemetry coverage, detection fidelity, and tuning processes meet enterprise quality, performance, and risk requirements.

Execution & Delivery of Complex Technical Initiatives

• Serve as the primary technical architect and decision authority for large‑scale, multi‑platform, cross‑organizational CIDR engineering initiatives.
• Resolve complex design tradeoffs across scale, performance, data quality, automation reliability, and security risk.
• Partner with teams across CDM, infrastructure, cloud, identity, engineering, and application platforms to resolve dependencies and drive successful execution.

Operational Excellence & Cross‑Functional Coordination

• Act as a senior escalation point and technical authority for detection and response issues surfaced through routine SOC operations or major investigations.
• Partner daily with SOC analysts, threat intelligence teams, CSIRT, engineering teams, and business stakeholders to ensure consistent operational readiness and high‑quality detection outcomes.
• Drive continuous improvement across the detection and response lifecycle, including triage, investigation, containment, and handoff to Incident Management.
• Ensure CIDR capabilities align with enterprise risk posture, resiliency expectations, and regulatory scrutiny.

Required Qualifications:

• 7+ years of cybersecurity engineering and technology experience, designing and operating complex security systems at enterprise scale.
• 5+ years of hands‑on SOC or incident response engineering experience, including alert pipelines, detection logic, response automation, and case management workflows.
• Deep technical expertise in SIEM architecture, data onboarding, normalization, correlation, large‑scale tuning, and performance optimization.
• Strong experience in detection engineering, SOC workflow design, and playbook/runbook development.
• Demonstrated ability to translate threat intelligence into detection logic at scale.
• Strong knowledge of incident response and detection frameworks (NIST 800‑61, MITRE ATT&CK/DEFEND).
• Exceptional communication skills and proven experience engaging executive, technical, and operational audiences.

Desired Qualifications:

• Familiarity with cloud, endpoint, identity, network, and third‑party ecosystems that underpin enterprise‑scale detection and response.
• Experience integrating internal and external threat intelligence feeds into SOC workflows.
• Experience using AI/ML capabilities in SOC environments (triage, correlation, anomaly detection).
• Professional certifications such as CISSP, CISM, CISA, GIAC‑GCIA/GCIH/GCTI, or equivalent.

Pay Range
 

Reflected is the base pay range offered for this position. Pay may vary depending on factors including but not limited to achievements, skills, experience, or work location. The range listed is just one component of the compensation package offered to candidates.

$159,000.00 - $305,000.00

Posting End Date:

25 Jan 2026

*Job posting may come down early due to volume of applicants.

We Value Equal Opportunity

Wells Fargo is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other legally protected characteristic.

Employees support our focus on building strong customer relationships balanced with a strong risk mitigating and compliance-driven culture which firmly establishes those disciplines as critical to the success of our customers and company. They are accountable for execution of all applicable risk programs (Credit, Market, Financial Crimes, Operational, Regulatory Compliance), which includes effectively following and adhering to applicable Wells Fargo policies and procedures, appropriately fulfilling risk and compliance obligations, timely and effective escalation and remediation of issues, and making sound risk decisions. There is emphasis on proactive monitoring, governance, risk identification and escalation, as well as making sound risk decisions commensurate with the business unit’s risk appetite and all risk and compliance program requirements.

Applicants with Disabilities

To request a medical accommodation during the application or interview process, visit Disability Inclusion at Wells Fargo.

Drug and Alcohol Policy

 

Wells Fargo maintains a drug free workplace.  Please see our Drug and Alcohol Policy to learn more.

Wells Fargo Recruitment and Hiring Requirements:

a. Third-Party recordings are prohibited unless authorized by Wells Fargo.

b. Wells Fargo requires you to directly represent your own experiences during the recruiting and hiring process.