Cyber Defense Analyst II
Core
Monitor, detect, and validate security threats across network, host, identity, and cloud telemetry while developing automation scripts and SOAR playbooks to reduce manual toil.
Role type
Mid-level IC Cyber Defense Analyst (Security Operations)
Builds
Automated detection rules, SOAR playbooks, and AI-augmented triage workflows for the Security Operations Center.
Domain
Cybersecurity / Security Operations / Cloud Security
Required skills
Telemetry analysis, Python/Rust/Java programming, API interaction, SOAR platform usage, Cloud telemetry (GCP/AWS), MITRE ATT&CK framework, Git version control, Threat hunting
Preferred skills
LLM usage for security investigations, CI/CD workflows, Cloud security certifications
Technologies
Python, Rust, Java, GCP, AWS, Cortex XSOAR, Splunk SOAR, Torq, Tines, Git, SIEM
Responsibilities
Analyze and triage security events to identify malicious activity and filter false positives; Write automation scripts and develop SOAR playbooks to automate repetitive monitoring tasks; Contribute to Detection-as-Code by developing and testing SIEM detection rules; Provide operational feedback on AI-assisted workflows and agentic triage outputs; Participate in hypothesis-driven threat hunts; Maintain documentation of monitoring processes and detection schemas.
Seniority
Mid-level, hands-on IC
