Cyber Threat Analyst (Detection & Automation Engineering)
Designs and maintains AI-enabled security detections and SOAR automation for a large Federal agency's SOC: integrating Splunk ES/SOAR, SentinelOne, and SIEM/EDR technologies, analyzing telemetry, and documenting workflows. Requires US citizenship and Public Trust clearance; role is remote within the US.
- Compensation
- Not disclosed
- Location
- US
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- Deep expertise in SOAR platforms (SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, Splunk SOAR)
- Expertise in AI/SI security
- SOC operations and processes
- Threat intelligence lifecycle and analysis
- Incident response methodologies
- Network protocols and architecture
- Operating systems: Windows/Linux/Unix
- Cloud platforms: AWS/Azure/GCP
- Security architecture and design
- Programming/scripting: Python, PowerShell, Bash
- API integration and development
- Detection engineering methodologies
- Security automation and orchestration concepts
- Familiarity with NIST SP 800-53, CIS Controls, MITRE ATT&CK
- Familiarity with CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars, Federal Cybersecurity Directives, Privacy Act
- Familiarity/experience with malware analysis
- Familiarity/experience with digital forensics analysis and procedures
- Familiarity/experience with risk assessment methodologies
- Bachelor's degree + 3–13 years in cybersecurity analysis/engineering, or 7–17 years in lieu of degree
- Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell)
- CompTIA Security+ or equivalent baseline cybersecurity certification
- At least one of: GIAC GCIA/GX-IA, GIAC GCIH/GX-IH, or CompTIA CySA+
- US citizenship and ability to obtain Public Trust clearance
- Excellent communication, organizational, and interpersonal skills; attention to detail; ability to work independently in a fast-paced environment
Nice to have
- CompTIA SecAI+ certification
- GIAC Continuous Monitoring (GMON) certification
- GIAC AI Security Automation Engineer (GASAE) certification
- GIAC Machine Learning Engineer (GMLE) certification
- CISSP certification
Full description
phia is hiring a Cyber Threat Analyst (Detection & Automation Engineering) to support cyber threat analysis and detection engineering and operations at a large Federal agency. The role requires close collaboration with security operations, threat intelligence, and incident response stakeholders, along with strong configuration development, testing, and documentation practices. The ideal candidate will have deep experience with cybersecurity threats and analysis workflows, detection capabilities and methodologies, and automation platforms and tools.
This position offers REMOTE work flexibility. Qualified candidates will be U.S. Citizens and located in the United States, able to achieve Public Trust security vetting approval.
What You’ll Do:
- Design, implement, and maintain automated, Artificial/Super Intelligence (AI/SI) enabled security detection, integration capabilities across enterprise security monitoring technologies.
- Strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows.
- Build automation and integration workflows to improve detection and response.
- Security Platform Integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
- Requirements-to-Implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
- Testing & Validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
- Security Data Analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
- Documentation & Sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations. Provide status and activity reporting and plans to management.
- Cross-Functional Coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
- Emerging Capability Evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.
Who You Are / What You Bring:
- Significant depth and expertise in:
- SOAR Platforms and Capabilities (SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, Splunk SOAR)
- Artificial Intelligence (AI) / Super Intelligence (SI) Security
- SOC operations and processes
- Threat intelligence lifecycle and analysis
- Incident response methodologies