Cyber Threat Analyst – Detection, Automation Engineering
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Cyber threat analyst automating security detection and integrations for phia, a federal cybersecurity services company. Supporting SOC, threat intelligence, and incident response operations.
Responsibilities:
- Design, implement, and maintain automated, AI/SI-enabled security detection and integration capabilities across enterprise security monitoring technologies
- Strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, and continuous improvement of detection content and workflows
- Build automation and integration workflows to improve detection and response
- Integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture
- Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions
- Execute testing, evaluation, and validation of detections and automation/SI workflows
- Drive continuous improvements based on testing results and operational feedback
- Analyze security telemetry to identify anomalies, trends, and detection gaps
- Recommend and implement detection enhancements
- Create and maintain technical documentation, SOPs, and runbooks
- Provide status and activity reporting and plans to management
- Collaborate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational processes
- Research and assess new security and SI/ML capabilities
- Support cyber threat analysis, detection engineering, and operations for a large Federal agency
- Collaborate closely with security operations, threat intelligence, and incident response stakeholders
Requirements:
- U.S. Citizens and located in the United States
- Able to achieve Public Trust security vetting approval
- Significant depth and expertise in SOAR platforms and capabilities, including SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, and Splunk SOAR
- Expertise in Artificial Intelligence (AI) / Super Intelligence (SI)
- Expertise in SOC operations and processes
- Expertise in threat intelligence lifecycle and analysis
- Expertise in incident response methodologies
- Expertise in network protocols and architecture
- Expertise in Windows/Linux/Unix operating systems
- Expertise in AWS/Azure/GCP cloud platforms
- Expertise in security architecture and design
- Programming/scripting proficiency in Python, PowerShell, Bash
- API integration and development experience
- Detection engineering methodologies
- Security automation and orchestration concepts
- Familiarity with NIST SP 800-53, CIS Controls, MITRE ATT&CK, CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars, Federal Cybersecurity Directives, and Privacy Act
- Experience with malware analysis, digital forensics analysis and procedures, and risk assessment methodologies
- Ability to work independently in a fast-paced environment with attention to detail
- Excellent communication, organizational, and interpersonal skills
- Bachelor's degree plus 3 to 13 years of experience in cybersecurity analysis and engineering, or four additional years of experience in lieu of a degree (7–17 years of experience)
- Programming/scripting certification or demonstrated proficiency, such as Python or PowerShell
- CompTIA Security+ or equivalent baseline cybersecurity certification
- At least one of: GIAC Certified Intrusion Analyst (GCIA) or GX-IA; GIAC Certified Incident Handler (GCIH) or GX-IH; CompTIA CySA+ Cybersecurity Analyst
- U.S. Citizenship required
- Ability to obtain Public Trust clearance
Benefits:
- Medical Insurance
- Dental Insurance
- Vision Insurance
- Life Insurance
- Short Term & Long Term Disability
- 401k Retirement Savings Plan with Company Match
- Paid Holidays
- Paid Time Off (PTO)
- Tuition and Professional Development Assistance
- REMOTE work flexibility
Similar Jobs
Lead Threat Hunter
Lead Threat Hunter leading intelligence-driven hunts across enterprise, cloud, OT/IoT, and AI environments. Turning adversary findings into durable detections for Allstate’s insurance and protection business.
Senior Threat Hunter
Senior Threat Hunter mentoring global security teams and building AI-driven cyber defense exercises. SimSpace provides an AI proving ground for training, testing, and validating cybersecurity defenses.
Senior Artificial Intelligence Analyst
Analista sênior desenvolvendo soluções com LLMs, IA generativa e APIs para o setor de saúde. Transformando protótipos em aplicações robustas com engenharia de software e MLOps no Grupo Fácil.
Field Intelligence Analyst
Field Intelligence Analyst guiding Sayari’s AI platform for economic security and commercial risk investigations. Owning customer engagements, validating AI analysis, and training analysts.
Threat Intelligence Specialist – APAC
Threat intelligence specialist protecting Kodex’s secure data exchange platform for law-enforcement agencies across APAC. Investigating identity fraud, threat actors, and urgent security cases during Singapore hours.
Senior Media Intelligence Analyst
Senior Media Intelligence Analyst delivering curated media reports, newsletters, and executive digests for Muck Rack’s AI-powered PR SaaS platform. Reviewing AI outputs and improving client service quality.
Senior Engineering Intelligence Analyst
Senior Engineering Intelligence Analyst building Looker dashboards and data pipelines for Five9’s cloud contact center software. Enabling engineering leaders to make faster, data-driven portfolio decisions.
Senior Threat Intelligence Specialist
Senior Threat Intelligence Specialist analyzing open-source cybersecurity incidents and vendor risks at Fortress Information Security. Producing assessments, improving intelligence processes, and supporting critical infrastructure protection.
Senior Revenue Intelligence Analyst
Revenue Intelligence Senior Analyst building sales models, dashboards, and forecasts for Teaching Strategies, an early childhood education technology company. Supporting revenue operations, Finance, sales teams, and leadership with actionable insights.
Senior Payor Intelligence Analyst
Payor intelligence analyst mapping U.S. insurance entities, policies, and authorization logic. Building data systems for Tennr’s healthcare paperwork automation platform.
Intelligence Analyst
Part-time Intelligence Analyst providing open-source cyber intelligence for DarkTower, which helps clients identify and reduce cyber risks. Researching threats, assessing risk, and producing actionable reports.
Senior Cyber Threat Analyst
Senior Cyber Threat Analyst leading ransomware communications, negotiations, and adversary intelligence. Supporting Vector3 and TMHCC incident response through analysis, documentation, and team mentorship.
Senior Cybersecurity Threat Hunter
Senior Cybersecurity Threat Hunter leading proactive threat detection at Uni Systems. Managing hunting campaigns, telemetry analysis, detection engineering, incident response support, and threat-informed security improvements.
Exposure Intelligence Analyst – Databases, Data Stores, RDBMS, NoSQL, Object Storage, Permissions
Exposure Intelligence Analyst securing Allstate’s databases, cloud data stores, and permissions. Identifying exploitable access paths and guiding remediation to reduce enterprise data exposure.
Intelligence Analyst
Intelligence Analyst supporting cyber threat customers and ensuring value realization from purchased Intelligence products at CrowdStrike.
Senior Cyber Threat Analyst
Senior Cyber Threat Analyst at Harbor IT investigating complex security incidents and communicating findings with clients. Collaborating with SOC analysts and providing escalation support.
Cyber Intelligence Analyst
Cyber Intelligence Analyst at UPS participating in threat identification and mitigation efforts. Provide support on a rotating basis, ensuring client understanding of security protocols and events documentation.
Cyber Threat Hunter
Cyber Threat Hunter protecting systems from cyber threats at a global insurance and asset management company. Utilizing automation and machine learning for scalable detection of anomalies and threats.
Exposure Intelligence Analyst – Endpoint & Identity, EDR, AD-Entra, PAM, MFA
Exposure Intelligence Analyst at Allstate identifying and prioritizing risks in endpoint and identity systems. Collaborating with teams to enhance security posture and mitigate vulnerabilities.
Exposure Intelligence Analyst – Cloud Platforms, AWS, Azure, GCP, Cloud Posture
Lead Consultant for cloud platforms securing cloud environments at Allstate. Identifying exploitable risks across AWS, Azure, and GCP while ensuring risk prioritization and remediation strategies.