Cyber Defense Analyst III

What you'll do

• Analyze and validate complex security events across network, host, identity, and cloud telemetry to identify malicious activity.
• Provide enriched and contextualized security alerts to the Incident Response team to ensure seamless handoffs.
• Develop Python scripts and SOAR playbooks to automate repetitive manual monitoring tasks within the SOC.
• Build, test, and deploy SIEM detection rules using Detection-as-Code principles, version control, and CI/CD pipelines.
• Test and refine AI-assisted workflows and agentic triage outputs to ensure high operational accuracy.
• Conduct hypothesis-driven threat hunts and operationalize threat intelligence into automated detection mechanisms.
• Provide technical mentorship to junior analysts regarding automation, critical thinking, and monitoring processes.
• Maintain detailed documentation of monitoring processes, playbook logic, and detection schemas in the Knowledge Management System.

What we're looking for

• 4–6 years of experience in a SOC, Detection Engineering, or advanced Cyber Defense monitoring environment.
• Deep knowledge of network protocols, OS internals (Windows/Linux/macOS), and MITRE ATT&CK framework tactics.
• Proficiency in Python or PowerShell for interacting with REST APIs, parsing JSON/XML, and automating security tasks.
• Hands-on experience building or modifying playbooks within modern SOAR platforms like Cortex XSOAR, Splunk SOAR, Torq, or Tines.
• Familiarity with cloud environments (preferably GCP or AWS) and investigating cloud-specific telemetry and identity abuse.
• Experience or strong interest in version control (Git), Detection-as-Code, and basic CI/CD workflows.
• Willingness to learn and adapt to emerging AI capabilities and LLM prompt refinement for security investigations.
• BA/BS in Computer Science, Information Security, Engineering, or a related field; relevant industry certifications are preferred.