Cyber Threat Analyst – Detection, Automation Engineering

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and uphold automated, AI/SI-driven security detection and integration capabilities across enterprise security monitoring technologies.

• Enhance threat detection and response through detection engineering, security automation, systems integration, data analysis, and the ongoing refinement of detection content and workflows.

• Create automation and integration workflows to boost detection and response efficiency.

• Integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a unified detection architecture.

• Conduct requirements analysis and translate operational security needs into technical specifications and actionable solutions.

• Perform testing, evaluation, and validation of detections and automation/SI workflows.

• Drive continuous enhancements based on testing outcomes and operational feedback.

• Analyze security telemetry to detect anomalies, trends, and detection deficiencies.

• Propose and implement detection improvements.

• Develop and maintain technical documentation, SOPs, and runbooks.

• Provide management with status updates and activity reports.

• Collaborate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational workflows.

• Research and evaluate new security and SI/ML capabilities.

• Support cyber threat analysis, detection engineering, and operations for a large Federal agency.

• Work closely with security operations, threat intelligence, and incident response stakeholders.

⛳️ Requirements

• U.S. Citizens residing in the United States.

• Must be able to obtain Public Trust security vetting approval.

• Extensive knowledge and expertise in SOAR platforms and capabilities, including SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, and Splunk SOAR.

• Proficient in Artificial Intelligence (AI) / Super Intelligence (SI).

• In-depth understanding of SOC operations and processes.

• Expertise in threat intelligence lifecycle and analysis.

• Knowledgeable in incident response methodologies.

• Proficient in network protocols and architecture.

• Skilled in Windows/Linux/Unix operating systems.

• Experienced with AWS/Azure/GCP cloud platforms.

• Expertise in security architecture and design.

• Proficiency in programming/scripting languages such as Python, PowerShell, and Bash.

• Experience in API integration and development.

• Familiar with detection engineering methodologies.

• Understanding of security automation and orchestration concepts.

• Familiar with standards such as NIST SP 800-53, CIS Controls, MITRE ATT&CK, CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars, Federal Cybersecurity Directives, and the Privacy Act.

• Experience with malware analysis, digital forensics analysis and procedures, and risk assessment methodologies.

• Capability to work independently in a fast-paced environment while maintaining attention to detail.

• Strong communication, organizational, and interpersonal skills.

• Bachelor’s degree plus 3 to 13 years of experience in cybersecurity analysis and engineering, or four additional years of experience in lieu of a degree (7–17 years of experience).

• Certification or demonstrated proficiency in programming/scripting, such as Python or PowerShell.

• CompTIA Security+ or an equivalent baseline cybersecurity certification.

• At least one of the following: GIAC Certified Intrusion Analyst (GCIA) or GX-IA; GIAC Certified Incident Handler (GCIH) or GX-IH; CompTIA CySA+ Cybersecurity Analyst.

• U.S. Citizenship is required.

• Ability to secure Public Trust clearance.

🏝️ Benefits

• Medical Insurance.

• Dental Insurance.

• Vision Insurance.

• Life Insurance.

• Short Term & Long Term Disability.

• 401k Retirement Savings Plan with Company Match.

• Paid Holidays.

• Paid Time Off (PTO).

• Tuition and Professional Development Assistance.

• REMOTE work flexibility.