Cyber Defense Analyst

RESPONSOBILTIES 

• Work with security stakeholders to analyze security needs and threat intelligence, translating them into formal technical requirements, system specifications, and process flows for security tools. 
• Design, document, and prototype advanced SIEM correlation rules, detection logic, and analytical models. Create specifications for custom dashboards, reports, and alerts to improve visibility for the SOC team. 
• Develop and document proactive threat hunting hypotheses and methodologies. Design systematic processes and technical requirements for hunting campaigns within existing and new security platforms. 
• Research, evaluate, and conduct Proof-of-Concept (PoC) engagements for new security technologies beyond SIEM (e.g., SOAR, EDR, NDR, Threat Intelligence Platforms) to enhance our defensive stack. 
• Create detailed specifications for onboarding new data sources into the SIEM. Design integration workflows and define API requirements for connecting disparate security systems to enable automated response actions. 
• Develop and maintain comprehensive documentation, including Functional Specification Documents (FSDs), data flow diagrams, and operational runbooks for the security solutions you design

QUALFICATIONS

• 2-3 years of experience in a hands-on cybersecurity role such as a SOC Analyst, Security Engineer, or Threat Hunter. 
• In-depth, hands-on experience with a major SIEM platform (e.g., Splunk, IBM QRadar, Microsoft Sentinel, LogRhythm), including experience in building complex detection rules and analytics. 
• Strong understanding of defensive security principles and frameworks, including the MITRE ATT&CK Framework, the Cyber Kill Chain, and defense-in-depth architecture. 
• Demonstrable experience in translating security concepts into technical documentation (e.g., requirements documents, design specifications, process flows). 
• Proficiency in at least one SIEM query language (e.g., SPL, KQL, AQL). 
• Proven experience in proactive threat hunting and developing novel detection techniques. 
• Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms and playbook development. 
• Scripting skills for automation and analysis (e.g., Python, PowerShell). 
• Knowledge of endpoint and network forensics. 
• Relevant industry certifications (e.g., CompTIA CySA+, GIAC GCIH, GCIA, or similar).