Information Security Risk Analyst at LAM

Setup: Hybrid
Level: mid
Posted: Jul 6, 2026

Summary from listing

The Cyber Threat Analytics Analyst will develop, test, tune, and maintain SIEM detection rules, log correlation searches, alerts, dashboards, and analytics; translate threat intelligence and adversary tactics into detections; use behavioral analytics, UEBA, and AI-assisted detection; map findings to MITRE ATT&CK; support SOC triage, incident response, and detection coverage improvements; and document detection logic and effectiveness metrics. The role requires experience with security operations, threat hunting, SIEM rule development, threat intelligence, incident response, detection tuning, and behavioral analytics, with preferred experience across major SIEM and security platforms, query languages, cloud monitoring, scripting, and threat-intelligence frameworks. The position offers On-site Flex or Virtual Flex hybrid work models.

Required Skills

SIEM
Threat intelligence
MITRE ATT&CK
UEBA
KQL
Python
Cloud security

Additional Information

Required Previous Experiences: Security Operations Center analysis
Threat hunting
SIEM rule development
Threat intelligence analysis
Incident response
Detection tuning
Behavioral analytics or UEBA
Cloud, endpoint, identity, or network security monitoring
Preferred Qualifications: Experience with Microsoft Sentinel, Splunk, Exabeam, Securonix, or similar SIEM platforms
Experience writing detection queries with KQL, SPL, SQL, or similar query languages
Familiarity with Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Microsoft Sentinel, Entra ID, or similar security platforms
Understanding of MITRE ATT&CK and common adversary tactics, techniques, and procedures
Experience using threat intelligence to create detections and threat hunting hypotheses
Experience with AI-assisted analytics, UEBA, anomaly detection, or behavioral baselining
Familiarity with cloud security monitoring across Azure, AWS, or Google Cloud
Ability to analyze logs from identity systems, endpoints, firewalls, proxies, email gateways, SaaS applications, and cloud platforms
Experience documenting detection logic, investigation steps, and response guidance
Scripting or automation experience with Python, PowerShell, Logic Apps, or similar tools
Familiarity with MISP, STIX/TAXII, threat intelligence feeds, or indicator management
Certifications such as GCIH, GCIA, GCDA, GMON, GCTI, GCFA, Security+, CySA+, CISSP, or equivalent experience