Use approved AI-assisted capabilities to summarize alerts, enrich cases, correlate evidence, develop investigative leads, and improve response speed while validating outputs against source data.
Execute established incident response playbooks, operational procedures, escalation paths, and human-review requirements.
Support evidence collection, documentation, containment activities, case tracking, remediation coordination, and incident closure.
Escalate incidents, uncertain AI outputs, access concerns, or decisions requiring advanced analysis to senior analysts and response teams.
Maintain situational awareness of active incidents, emerging threats, and operational risks during assigned shifts.
Threat Analysis, Hunting & AI-Augmented Detection Engineering
Correlate endpoint, network, identity, cloud, application, and security telemetry to identify indicators of compromise and suspicious activity.
Assist in identifying attacker tactics, techniques, and procedures through investigative analysis, threat intelligence, and behavioral context.
Use OSINT, threat intelligence feeds, approved AI tools, and operational reporting to support investigations and improve threat visibility.
Support hypothesis-driven threat hunting to identify emerging risks and previously undetected malicious behavior.
Assist in developing, tuning, testing, and maintaining detection content, alert logic, analytics rules, dashboards, and use cases.
Use AI as a supervised aid for query development, alert clustering, detection documentation, false-positive review, and coverage-gap analysis.
Identify recurring attack patterns, false positives, telemetry gaps, and opportunities to improve detection effectiveness.
Develop working knowledge of MITRE ATT&CK, threat modeling, NIST incident response concepts, and modern detection methodologies.
Security Engineering, Automation & AI Agent Operations
Support deployment, configuration, maintenance, and optimization of security operations technologies and integrations.
Support SOAR, workflow automation, orchestration, and AI-assisted security operations initiatives.
Use scripting, query languages, APIs, and automation tools to improve investigation workflows, reporting, enrichment, and repeatable operational tasks.
Assist senior analysts and engineers with configuring, testing, and tuning AI agents for defined SecOps use cases such as triage, enrichment, knowledge retrieval, reporting, threat hunting, and detection support.
Help refine agent instructions, retrieval content, context, tool access, guardrails, escalation logic, and evaluation of test cases within approved boundaries.
Record agent errors, unsupported claims, inconsistent results, access issues, and workflow failures; provide structured feedback for tuning and improvement.
Validate AI-agent outputs against authoritative telemetry and case evidence before they are used in investigations or operational decisions.
Collaborate with engineering and security teams to improve visibility, strengthen controls, and evaluate emerging AI-driven security capabilities.
AI SOC Innovation & Continuous Improvement
Contribute to AI SOC initiatives by helping identify repeatable analyst pain points, candidate use cases, automation opportunities, and measurable success criteria.
Participate in proofs of concept, controlled pilots, user acceptance testing, agent evaluations, and post-deployment feedback activities.
Help document AI-enabled workflows, expected outputs, known limitations, human-review steps, escalation paths, and fallback procedures.
Provide analyst feedback on usability, trust, accuracy, efficiency, and operational risk to improve AI SOC capabilities.
Demonstrate responsible experimentation, professional accountability, and willingness to learn from testing and operational outcomes.
Documentation, Communication & Collaboration
Produce incident summaries, investigation reports, shift handoffs, operational updates, and concise AI evaluation findings.
Communicate technical findings, confidence, limitations, and recommended next steps to technical and non-technical stakeholders.
Support metrics for detection quality, investigation speed, automation reliability, agent accuracy, analyst adoption, and program effectiveness.
Partner with security, infrastructure, engineering, risk, privacy, legal, and business teams as appropriate to support cybersecurity and AI SOC initiatives.
1-3 years of experience in Security Operations, Incident Response, IT Operations, Security Engineering, or a related cybersecurity environment.
Experience monitoring, triaging, investigating, and escalating security events using established operational processes.
Experience supporting incident response and documenting investigations through closure.
Ability to work independently on assigned tasks while collaborating effectively within a team and escalating when appropriate.
Foundational understanding of security operations, threat detection, incident response, security engineering, and responsible use of automation or AI.
Working knowledge of networking, authentication, operating systems, cloud technologies, and enterprise security controls.
Familiarity with Windows, Linux/Unix, macOS, and cloud computing platforms.
Experience with technologies such as SIEM, EDR, IDS/IPS, DLP, SOAR, email security, IAM, vulnerability management, and log analysis platforms.
Understanding of indicators of compromise, attack methodologies, detection logic, and basic malware concepts.
Strong analytical, problem-solving, communication, collaboration, prioritization, and documentation skills.
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, or equivalent practical experience.
