We are seeking an experienced Threat Analytics Engineer to design, develop, and maintain advanced security analytics capabilities to identify, investigate, and mitigate cyber threats across enterprise environments. The ideal candidate will have strong expertise in SIEM engineering, threat detection, security data analytics, threat hunting, and detection rule development.
The candidate will analyze security telemetry, endpoint logs, network events, identity activities, and cloud security data to identify malicious behavior and emerging attack patterns. Experience leveraging AI/ML, behavioral analytics, and automation to improve threat detection and reduce false positives is highly desirable.
Design, develop, and maintain threat detection analytics, correlation rules, and security use cases.
Analyze security events and telemetry from endpoints, networks, cloud environments, and identity systems.
Develop detection logic to identify malware, ransomware, phishing, privilege escalation, lateral movement, and suspicious user activity.
Build and optimize SIEM queries, dashboards, alerts, and correlation searches.
Perform proactive threat hunting using security analytics, threat intelligence, and behavioral indicators.
Develop and maintain detection rules mapped to the MITRE ATT&CK framework.
Apply statistical analysis, anomaly detection, and AI/ML techniques to identify unknown or emerging threats.
Integrate security data sources from EDR/XDR, firewalls, identity providers, cloud platforms, and threat intelligence feeds.
Tune detection rules to reduce false positives and improve detection coverage.
Develop scripts and automation using Python, SQL, KQL, SPL, or similar query and scripting languages.
Collaborate with SOC analysts, incident responders, threat hunters, and security engineering teams.
Conduct root-cause analysis of security incidents and translate findings into reusable detection logic.
Monitor detection performance and improve metrics such as alert precision, detection coverage, and mean time to detect.
Maintain technical documentation for analytics rules, detection logic, data pipelines, and investigation procedures.
5+ years of experience in cybersecurity, threat analytics, security engineering, or detection engineering.
Strong hands-on experience with SIEM platforms such as:
Microsoft Sentinel
Splunk Enterprise Security
IBM QRadar
Google Security Operations
Experience developing security detection rules, correlation searches, alerts, and dashboards.
Strong proficiency in at least one of Python, SQL, KQL, or SPL.
Understanding of security logs, endpoint telemetry, network traffic, identity events, and cloud audit logs.
Knowledge of threat hunting, incident response, malware behavior, and common attack techniques.
Experience with MITRE ATT&CK, Indicators of Compromise (IOCs), and threat intelligence.
Understanding of EDR/XDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Palo Alto Cortex XDR.
Knowledge of detection tuning, false-positive reduction, and security data analysis.
Strong analytical, troubleshooting, and problem-solving skills.
