Cyber Threat Detection & Response Analyst

What you'll do

• Implement and maintain log collection for endpoints, network devices, cloud services, and identity systems.
• Onboard data sources and manage the performance, parsing, and normalization of SIEM and EDR/XDR platforms.
• Create, implement, and tune detection rules to improve alert fidelity and reduce noise.
• Support incident response by collecting evidence, assisting with containment, and coordinating engineering fixes.
• Develop and test SOAR playbooks to automate and streamline repetitive security response tasks.
• Execute test plans for detections and response workflows to identify gaps and improve coverage.
• Map detections to common tactics and techniques using frameworks like MITRE ATT&CK.
• Document all work including use cases, runbooks, change records, and technical specifications.

What we're looking for

• Bachelor's degree in computer science, information security, engineering, or a related field (or equivalent experience).
• 4+ years of relevant experience in cybersecurity and/or IT operations.
• Experience with security monitoring tools including SIEM, EDR/XDR, IDS/IPS, and logging agents.
• Proficiency in onboarding log sources and managing telemetry pipelines for Windows, Linux, and cloud environments.
• Ability to create, tune, and document detection rules while following change management processes.
• Basic scripting skills in Python, PowerShell, or Bash and willingness to learn query languages like SPL/KQL.
• Familiarity with security frameworks such as MITRE ATT&CK, NIST, or CIS Benchmarks.
• Security+, SSCP, or other foundational certifications (preferred); TDR/SecOps specific certifications (preferred).