Information Security Risk Analyst
Core
Develop, tune, and maintain SIEM detection rules, log correlation searches, and analytics to identify malicious behavior, suspicious activity, and security anomalies across the enterprise.
Role type
Information Security Risk Analyst (Threat Analytics)
Builds
Detection rules, analytics, dashboards, and threat intelligence integrations
Domain
Cybersecurity / Threat Intelligence / SIEM
Deliverable
production ML models
Required skills
SIEM rule development, log correlation, threat intelligence analysis, behavioral analytics, MITRE ATT&CK mapping, incident response support, gap analysis, documentation, metrics tracking
Preferred skills
UEBA, AI-assisted analytics, cloud security monitoring, scripting/automation, threat intelligence platforms (MISP, STIX/TAXII)
Technologies
Microsoft Sentinel, Splunk, Exabeam, Securonix, KQL, SPL, SQL, Microsoft Defender XDR, Entra ID, Azure, AWS, Google Cloud, Python, PowerShell, Logic Apps, MISP
Responsibilities
Develop, test, tune, and maintain SIEM detection rules, log correlation searches, alerts, dashboards, and analytics; Translate threat intelligence, adversary tactics, and emerging attack trends into actionable detections; Build and improve analytics to identify malicious behavior, compromised accounts, lateral movement, and anomalous activity; Use AI-driven analytics, UEBA, and behavioral baselining to identify activity that deviates from normal user, endpoint, network, cloud, and application behavior; Map detection content to MITRE ATT&CK tactics and techniques to identify coverage strengths and gaps; Partner with SOC analysts to improve alert triage, investigation playbooks, enrichment, and escalation criteria; Support Incident Response during active investigations by analyzing logs, identifying patterns, and developing new detections from lessons learned; Identify gaps in logging, telemetry, and visibility and recommend improvements to security monitoring coverage; Document detection logic, assumptions, data sources, expected behavior, response guidance, and tuning decisions; Track detection effectiveness, alert fidelity, false positive rates, detection coverage, and time-to-detect improvements
Seniority
Mid-level, hands-on IC
