Cyber Threat Analyst – Detection, Automation Engineering

phia, LLC

. Design, implement, and maintain automated, AI/SI-enabled security detection and integration capabilities across enterprise security monitoring technologies .

Posted 10/24/2026full-timeRemote • United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security automation, detection engineering, and incident response methodologies, with proficiency in SOAR platforms and cloud technologies. Capable of translating operational security needs into technical specifications and implementing cohesive detection architectures.

Highest-signal resume keywords

SOAR Platforms ExpertiseDetection Engineering MethodologiesSecurity Automation and OrchestrationProgramming/Scripting Proficiency in PythonIncident Response Methodologies

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection EngineeringSecurity AutomationAPI IntegrationData AnalysisMalware AnalysisDigital ForensicsNetwork ProtocolsWindows/Linux/Unix Operating SystemsCloud Platforms (AWS/Azure/GCP)Threat Intelligence Analysis

Soft Skills

Excellent CommunicationOrganizational SkillsInterpersonal SkillsAttention to DetailAbility to Work Independently

Tools & Technologies

SentinelOne Singularity HyperautomationSplunk Enterprise SecuritySplunk SOARSIEM TechnologiesEDR TechnologiesSOAR TechnologiesThreat Intelligence TechnologiesSecurity Monitoring TechnologiesAutomation WorkflowsSecurity Detection Capabilities

Certifications & Qualifications

CompTIA Security+GIAC Certified Intrusion Analyst (GCIA)GIAC Certified Incident Handler (GCIH)CompTIA CySA+ Cybersecurity AnalystProgramming/Scripting Certification

Industry Keywords

NIST SP 800-53CIS ControlsMITRE ATT&CKCISA NICE FrameworkISO 27001/27002FISMAFedRAMPOMB CircularsFederal Cybersecurity DirectivesPrivacy Act

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformLinuxPythonSplunkUnix

About the role

Key responsibilities & impact

Design, implement, and maintain automated, AI/SI-enabled security detection and integration capabilities across enterprise security monitoring technologies
Strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, and continuous improvement of detection content and workflows
Build automation and integration workflows to improve detection and response
Integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture
Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions
Execute testing, evaluation, and validation of detections and automation/SI workflows
Drive continuous improvements based on testing results and operational feedback
Analyze security telemetry to identify anomalies, trends, and detection gaps
Recommend and implement detection enhancements
Create and maintain technical documentation, SOPs, and runbooks
Provide status and activity reporting and plans to management
Collaborate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational processes
Research and assess new security and SI/ML capabilities
Support cyber threat analysis, detection engineering, and operations for a large Federal agency
Collaborate closely with security operations, threat intelligence, and incident response stakeholders

Requirements

What you’ll need

U.S. Citizens and located in the United States
Able to achieve Public Trust security vetting approval
Significant depth and expertise in SOAR platforms and capabilities, including SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, and Splunk SOAR
Expertise in Artificial Intelligence (AI) / Super Intelligence (SI)
Expertise in SOC operations and processes
Expertise in threat intelligence lifecycle and analysis
Expertise in incident response methodologies
Expertise in network protocols and architecture
Expertise in Windows/Linux/Unix operating systems
Expertise in AWS/Azure/GCP cloud platforms
Expertise in security architecture and design
Programming/scripting proficiency in Python, PowerShell, Bash
API integration and development experience
Detection engineering methodologies
Security automation and orchestration concepts
Familiarity with NIST SP 800-53, CIS Controls, MITRE ATT&CK, CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars, Federal Cybersecurity Directives, and Privacy Act
Experience with malware analysis, digital forensics analysis and procedures, and risk assessment methodologies
Ability to work independently in a fast-paced environment with attention to detail
Excellent communication, organizational, and interpersonal skills
Bachelor's degree plus 3 to 13 years of experience in cybersecurity analysis and engineering, or four additional years of experience in lieu of a degree (7–17 years of experience)
Programming/scripting certification or demonstrated proficiency, such as Python or PowerShell
CompTIA Security+ or equivalent baseline cybersecurity certification
At least one of: GIAC Certified Intrusion Analyst (GCIA) or GX-IA; GIAC Certified Incident Handler (GCIH) or GX-IH; CompTIA CySA+ Cybersecurity Analyst
U.S. Citizenship required
Ability to obtain Public Trust clearance

Benefits

Comp & perks

Medical Insurance
Dental Insurance
Vision Insurance
Life Insurance
Short Term & Long Term Disability
401k Retirement Savings Plan with Company Match
Paid Holidays
Paid Time Off (PTO)
Tuition and Professional Development Assistance
REMOTE work flexibility