AI Detection Engineer - SOC Analyst IV

Detection Engineering & Content Development ● Design, develop, and deploy advanced detection rules and logic across SIEM, EDR, CSPM, and cloud-native security platforms. ● Build and maintain detection-as-code using modern frameworks and version control systems (Git). ● Create high-fidelity, low-noise detections mapped to the MITRE ATT&CK framework, focusing on cloud-specific threats and techniques. ● Continuously research emerging threats, TTPs (Tactics, Techniques, and Procedures), and translate threat intelligence into actionable detection content. ● Perform detection efficacy testing and validation using purple team exercises and adversary emulation frameworks. AI & Machine Learning Integration ● Leverage AI/ML capabilities within security platforms to enhance threat detection accuracy and reduce false positives. ● Build and tune machine learning models for anomaly detection, behavioral analytics, and predictive threat identification. ● Integrate generative AI and large language models (LLMs) to accelerate alert triage, investigation workflows, and threat analysis. ● Evaluate and implement AI-powered security tools for automated threat detection, alert enrichment, and investigation assistance. ● Monitor and optimize AI/ML model performance, addressing data quality, model drift, and false positive/negative rates.

Cloud Security Detection & Monitoring ● Act as a Subject Matter Expert (SME) for cloud security detection engineering across AWS, Azure, and GCP environments. ● Design detections leveraging cloud-native logs (CloudTrail, Azure Activity Logs, GCP Audit Logs) and security services (GuardDuty, Security Command Center, Defender for Cloud). ● Build detections for cloud-specific threats including misconfigurations, identity compromise, data exfiltration, and infrastructure attacks. ● Monitor container and Kubernetes environments, developing detections for runtime threats and supply chain attacks. Security Automation & Orchestration ● Design and implement automated detection deployment pipelines using secure CI/CD methodologies. ● Build custom scripts (Python, PowerShell, Bash) for automated alert enrichment, evidence collection, and response actions. ● Develop and maintain automated response playbooks in SOAR platforms to handle detection-triggered workflows. ● Integrate security tools via APIs to create seamless, automated detection and response ecosystems. ● Identify opportunities to apply automation and AI to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Continuous Improvement & Collaboration ● Analyze detection performance metrics, false positive rates, and coverage gaps to drive continuous improvement. ● Collaborate with threat intelligence, incident response, and threat hunting teams to refine detection strategies. ● Create and maintain comprehensive documentation for detection logic, tuning procedures, and operational runbooks. ● Provide technical guidance on detection engineering best practices and emerging technologies. ● Stay current with the latest security research, adversary techniques, and AI/ML advancements in cybersecurity.