Threat Detection Analyst (Expert)

Description

This position is an onsite position and is available to be filled at any Huntington Corporate office location:

Detroit, MI

Dallas, TX

Columbus, OH

Pittsburgh, PA

Minnetonka, MN

Atlanta, GA

Threat Detection Analyst (Expert)

The Threat Detection Analyst Expert develops, tunes, validates, and maintains threat detection content across the organization's security platforms. This role leverages threat intelligence, adversary tradecraft, attack simulations, and data analytics to identify detection opportunities and improve visibility into malicious activity. Analyze security telemetry, threat trends, and attack techniques to create high-fidelity detections that identify threats across the enterprise.

The Threat Detection Analyst Expert works closely with Incident Response, Cybersecurity Operations, Threat Intelligence, Security Engineering, and IT Operations teams to improve detection coverage, reduce detection gaps, and enhance the organization's ability to identify adversary behavior. This role is responsible for the full detection lifecycle, including design, testing, deployment, tuning, validation, and continuous improvement of threat detections.

Threat Detection Analyst Responsibilities

Provide leadership, mentorship, and training opportunities for junior Threat Detection Analysts.

Design, develop, test, deploy, and maintain threat detections across SIEM, XDR, EDR, cloud, and network security platforms.

Conduct detection engineering activities aligned to the MITRE ATT&CK framework and known adversary behaviors.

Analyze threat intelligence, attack techniques, and emerging threats to identify new detection opportunities.

Develop and maintain detection use cases, analytics, correlation rules, anomaly detections, and behavioral detections.

Perform detection validation through threat simulations, purple team exercises, adversary emulation, and attack replay testing.

Conduct detection gap assessments and identify areas requiring additional visibility or telemetry.

Continuously tune and optimize detection logic to improve fidelity and reduce false positives and false negatives.

Create and maintain detection documentation, testing procedures, and coverage mappings.

Analyze security telemetry and log sources to identify opportunities for improved monitoring coverage.

Develop content and requirements for new log sources, telemetry collection, and data quality improvements.

Partner with Incident Response teams to improve detection content based on investigations and lessons learned.

Collaborate with Threat Intelligence teams to operationalize indicators, emerging threats, and attacker TTPs.

Maintain awareness of emerging attack techniques, cybersecurity trends, and advancements in detection methodologies.

Measure and report on detection health, coverage effectiveness, and detection performance metrics.

Perform other duties as assigned.

Basic Qualifications:

High School Diploma or 8+ additional years of equivalent experience.

5+ years of experience in Cybersecurity.

1+ years data analytics experience within the threat detection space.

Preferred Qualifications

• Bachelor's degree or 4+ additional years of equivalent experience.
• Professional experience with Palo Alto Cortex XSIAM, Microsoft Sentinel, Splunk, Microsoft Defender XDR, or similar detection platforms.
• Strong experience developing, testing, deploying, and maintaining threat detections across enterprise security technologies.
• Experience creating detection logic based on MITRE ATT&CK techniques, threat intelligence, and real-world adversary behaviors.
• Experience conducting detection validation using attack simulation, adversary emulation, or purple team methodologies.
• Experience tuning detections to reduce false positives while maintaining detection efficacy.
• Ability to conduct detection coverage analysis and detection gap assessments.
• Familiarity with detection-as-code methodologies and version-controlled detection development processes.
• Experience writing and optimizing KQL, SPL, XQL, SQL, or similar analytics languages.
• Strong understanding of attacker tactics, techniques, and procedures (TTPs).
• Experience working with large-scale security telemetry and log analytics.
• Knowledge of common attack vectors including phishing, credential theft, ransomware, cloud attacks, insider threats, and lateral movement.
• Familiarity with threat hunting concepts and the conversion of hunt hypotheses into operational detections.
• Understanding of Windows, Linux, macOS, Active Directory, Azure AD/Entra ID, and cloud security telemetry.
• Experience with scripting and automation using Python, PowerShell, Bash, or similar languages.
• Knowledge of common network protocols such as HTTP/S, DNS, SMTP, SSH, LDAP, and Kerberos.
• Understanding of cybersecurity frameworks including MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and detection engineering best practices.
• Strong analytical, communication, presentation, and problem-solving skills.
• Occasional travel may be required (<10%).
• Exempt Status: (Yes   = not eligible for overtime pay) ( No   = eligible for overtime pay)
• Yes
• Workplace Type: Office
• Our Approach to Office Workplace Type
• Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds:  in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.