Cyber Security Analyst II

Summary

We are seeking a Cyber Security Analyst II to join a high-performing Threat Detection & Intelligence team within a large, complex enterprise environment. This role is ideal for professionals who thrive at the intersection of threat intelligence, detection engineering, and proactive cyber defense. In our Defense Centre, we don’t simply react to alerts—we analyze emerging threats, simulate adversary tactics, and engineer detection capabilities grounded in real-world attacker behavior. You will play a key role in identifying and assessing evolving threats, translating intelligence into actionable detection content, and continuously strengthening our ability to detect and respond to sophisticated cyber attacks. If you think like an adversary, challenge assumptions, and are passionate about building detection systems—not just monitoring alerts—this is an opportunity to make a meaningful impact on the security of a critical enterprise environment.

Key Responsibilities

Threat Intelligence & Analysis
o    Analyze and classify threat reports, campaigns, and attacker behaviors (TTPs)
o    Track and profile threat actors, motivations, and evolving tradecraft
o    Transform intelligence into operationalized detections aligned with MITRE ATT&CK
o    Validate intelligence quality, including AI-assisted outputs and datasets
o    Support investigations with adversary context, scoping, and attribution insights
o    Partner with Defence Center, IR, fraud, and engineering teams to improve response
o    Provide clear intelligence reporting to both technical and executive audiences

 Detection Engineering & Platform Integration
o    Support the development of value-add detections for our Defense Centre teams
o    Develop, test, and optimize detections using detection-as-code practices
o    Continuously improve detection coverage and reduce false positives
o    Build scalable detection pipelines (CI/CD, automated validation, purple teaming)
o    Design integrations across SIEM, EDR, SOAR, TIPs, and internal telemetry
o    Engineer data pipelines leveraging Kafka, Elastic, parsing, normalization, and data views
o    Develop dashboards and analytics to track threats, coverage, and detection efficacy

Critical Qualifications

•    5–8+ years in Threat Intelligence, Threat Hunting, or Advanced Cyber Security roles (large enterprise preferred)
•    Deep knowledge of MITRE ATT&CK, kill chain models, and adversary tradecraft
•    Strong hands-on experience with: SIEM analytics (Splunk, Sentinel, Elastic, etc.) and Log analysis, correlation, and detection logic development
•    Solid understanding of networking & infrastructure (TCP/IP, OSI, network telemetry, IDS/IPS)
•    Experience working with log ingestion pipelines (Kafka, Elastic), including data parsing, normalization, and enrichment
•    Scripting/automation skills (Python, PowerShell, APIs)
•    Ability to translate intelligence into detections and measurable outcomes
•    Experience leading complex investigatio

Preferred Qualifications

•    Threat Intelligence Platform (TIP) experience (IOC lifecycle, STIX/TAXII)
•    Detection engineering frameworks (Sigma, YARA) and CI/CD pipelines
•    Cloud security experience (AWS, Azure, GCP) and cloud telemetry
•    Experience with SOAR automation and playbook development
•    Exposure to AI/ML-assisted detection or intelligence workflows
•    Malware analysis, red team/purple team, or reverse engineering experience
•    Experience with dark web monitoring or adversary tracking