JOB DESCRIPTION
Insight Global is seeking a Senior Security Analyst to design and maintain high‑fidelity, behavior‑based security detections aligned to the MITRE ATT&CK framework. This role focuses on SIEM/EDR detection engineering, automation using SOAR and Logic Apps, and close collaboration with SOC and Incident Response teams.
REQUIRED SKILLS AND EXPERIENCE
Detection Engineering Experience
- 8+ years of experience in cybersecurity, with at least 3+ years focused on detection engineering, threat detection, or security analytics
- Proven experience designing, implementing, and maintaining high fidelity security detections across multiple telemetry sources
- Strong understanding of how attacker behaviors manifest in logs, events, and telemetry across enterprise environments
Detection Design & Framework Alignment
- Demonstrated experience building detections aligned to MITRE ATT&CK, focusing on behavior based rather than signature only detection
- Ability to perform detection gap analysis and systematically improve coverage, quality, and resilience of detection content
- Experience validating detections through testing, simulation, or retrospective analysis [Security O...n Engineer | Word]
Security Tooling & Query Languages
- Hands on experience with SIEM and EDR platforms, including ingesting and querying large volumes of security telemetry
- Strong proficiency writing detection logic using KQL and working with Microsoft Sentinel/Defender
- Experience using scripting languages such as Python, PowerShell, Bash, or JavaScript to support detection and automation workflows
Automation & SOAR
- Experience designing and implementing security automation using SOAR platforms to reduce manual effort and improve response consistency
- Ability to automate alert enrichment, triage, IOC lookups, and ticketing workflows using Logic Apps
- Experience integrating SIEM, EDR, threat intelligence, and case management systems into cohesive workflows
Operational Collaboration
- Strong collaboration with SOC analysts, Incident Response, and Threat Intelligence teams to ensure detections are actionable and operationally effective
- Ability to support incident response by providing deep technical insight into detections, telemetry, and attacker behaviors
Original contract set for 5 months with the opportunity to extend
