The Information Security Risk Analyst joins the Information Security team to identify and improve the organization’s ability to detect malicious behavior and security anomalies. This role focuses on detection development, threat analysis operationalization, SIEM correlation, behavioral analytics, and AI-assisted threat detection. You will develop, test, and maintain SIEM detection rules, log correlation searches, and dashboards while translating threat intelligence into actionable detections. Key responsibilities include building analytics for compromised accounts and lateral movement, mapping content to MITRE ATT&CK, and supporting incident response. Required skills include experience with SIEM platforms like Microsoft Sentinel or Splunk, query languages such as KQL, SPL, or SQL, and familiarity with Microsoft Defender XDR. You will analyze logs from endpoints, identity systems, cloud platforms, and network data to identify suspicious signals.
Develop, test, tune, and maintain SIEM detection rules, log correlation searches, and dashboards.
Translate threat intelligence and adversary tactics into actionable security detections.
Build analytics to identify malicious behavior, compromised accounts, and lateral movement.
Use AI-driven analytics and UEBA to identify deviations from normal user and network behavior.
Map detection content to the MITRE ATT&CK framework to identify coverage gaps.
Support incident response by analyzing logs and developing new detections from lessons learned.
Identify gaps in logging and telemetry to improve overall security monitoring coverage.
Track and report on detection effectiveness, alert fidelity, and false positive rates.
What we're looking for
Experience in one or more areas including SOC analysis, threat hunting, SIEM rule development, threat intelligence, incident response, or behavioral analytics.
Ability to translate threat intelligence and adversary tactics into actionable detections and hunt hypotheses (preferred).
Experience with SIEM platforms such as Microsoft Sentinel, Splunk, Exabeam, or Securonix (preferred).
Experience writing detection queries using KQL, SPL, SQL, or similar query languages (preferred).
Familiarity with Microsoft Defender XDR, Entra ID, or similar security platforms (preferred).
Experience with AI-assisted analytics, UEBA, anomaly detection, or behavioral baselining (preferred).
Scripting or automation experience with Python, PowerShell, Logic Apps, or similar tools (preferred).
Certifications such as GCIH, GCIA, GCDA, GMON, GCTI, GCFA, Security+, CySA+, CISSP, or equivalent experience (preferred).
Cybersecurity Governance
Risk Management
Compliance
NIST 800-53
DoD 8500
AWS
Azure
Google Cloud Platform
eMASS
Next-Generation Firewall
AI
Machine Learning
Big Data
Information Security
Audit