Cyber Threat Analyst-Detection Engineer

Core Roles & Responsibilities

• Detection Engineering & Automation/SI: Build automation/SI and integration workflows to improve detection and response.
• Security platform integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
• Requirements-to-implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
• Testing & validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
• Security data analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
• Documentation & sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations.
• Cross-functional coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
• Emerging capability evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.

Essential Technical Knowledge Areas (plus important/beneficial)

• SOAR Tools: SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, Splunk SOAR
• Super Intelligence (SI) Security
• SOC operations and processes
• Threat intelligence lifecycle and analysis
• Incident response methodologies
• Network protocols and architecture
• Operating systems (Windows/Linux/Unix)
• Cloud platforms (AWS/Azure/Google Cloud Platform)
• Security architecture and design
• Programming/scripting (Python, PowerShell, Bash)
• API integration and development
• Detection engineering methodologies
• Security automation and orchestration concepts

Frameworks, Standards & Compliance Expectations

• NIST SP 800-53 Security Controls
• CIS Controls
• MITRE ATT&CK Framework

Important/beneficial

• CISA NICE Framework
• ISO 27001/27002
• FISMA
• FedRAMP
• OMB Circulars and Federal Cybersecurity Directives
• Privacy Act

Important / Beneficial

• Malware analysis
• Digital forensics procedures
• Risk assessment methodologies
• Machine learning and SI for security

Certification Requirements

• CompTIA Security+ (or equivalent baseline)
• One of: GCIA, GCIH, or CompTIA CySA+
• Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell, similar)

Preferred

• CISSP or GIAC Security Essentials (GSEC)
• Comptia SecAI+
• GMON (or similar continuous monitoring/detection-focused certification)