AI-Driven Cyber Defense & SOC Automation Analyst

Micron; Boise (ID); Hybrid; USD 110,000 - 160,000; Full time

Job summary

Micron Technology in Boise, Idaho seeks a CSOC Analyst / AI-Automation Engineer to advance security operations, threat investigation, and AI-enabled automation. This hybrid role blends hands-on defense with engineering of reusable playbooks and automation to improve detection and response.

You will design AI-assisted capabilities, build automated responses with Python, PowerShell, and REST APIs, and measure outcomes like time to triage and analyst hours saved, helping strengthen defense for

Responsibilities

• Investigate, triage, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments.
• Hunt for malicious or anomalous activity, and correlate telemetry across security platforms to determine scope, impact, and the right response.
• Implement and continuously improve incident response and investigation playbooks.
• Partner with threat intelligence, detection engineering, incident response, vulnerability management, and other security teams on complex investigations.
• Develop and tune detections based on emerging threats, attack techniques, intelligence, and lessons learned from investigations.
• Identify detection gaps and recommend improvements to telemetry, correlation, and response logic.
• Translate analyst knowledge and investigation techniques into repeatable detection and response capabilities.
• Use frameworks such as MITRE ATT&CK to structure detection and threat-hunting coverage.
• Identify repetitive analyst work and decide whether to automate, eliminate, redesign, or keep it manual, based on volume, risk, and how often the process changes.
• Build scripts, playbooks, and integrations with Python, PowerShell, REST APIs, SOAR, and workflow platforms that connect security tools, telemetry sources, and case-management systems.
• Engineer them to production standard, with error handling, retries, idempotent actions, structured logging, and alerts when an automation fails or silently stops.
• Add proportionate safeguards to automated response: human approval for disruptive actions such as host containment, account disablement, or mailbox purges, plus exclusion lists, action limits, and tested rollback.
• Manage automation as code, with source control, peer review, non-production testing, and change-managed promotion.
• Use least-privilege service identities and managed secrets, and maintain credentials and API permissions over their full lifecycle.
• Own what you build by documenting it, monitoring its health, and maintaining it as upstream tools change.
• Measure outcomes such as analyst hours returned, time to triage and respond, consistency, and error rates.
• Focus especially on the risk that automation might close cases needing advancement.
• Design, build, and operate AI agents that support investigation, enrichment, threat analysis, and response by querying SIEM, EDR, identity, threat intelligence, and case-management systems.
• Build the agent tools with MCP and platform APIs, using narrowly scoped, least-privilege access and separating read-only from state-changing actions.
• Match autonomy to each use case so that AI informs judgment while policy-based controls govern high-impact decisions.
• Encode analyst expertise as reusable instructions and skills grounded in trusted sources such as runbooks and prior cases.
• Defend against prompt injection from untrusted content.
• Evaluate agents against historical analyst ground truth and run them in shadow mode before granting autonomy.
• Log prompts, tool calls, and evidence so every AI-influenced action is auditable.
• Require cited evidence and validation before AI analysis drives decisions.
• Look for places where AI can augment analyst judgment, not just automate existing processes.
• Treat every investigation as an opportunity to improve the broader defense capability.
• Document investigation logic so that analyst knowledge can be converted into detections, automation, pl

Job description

Micron Technology in Boise, Idaho seeks a CSOC Analyst / AI-Automation Engineer to advance security operations, threat investigation, and AI-enabled automation. This hybrid role blends hands-on defense with engineering of reusable playbooks and automation to improve detection and response.

You will design AI-assisted capabilities, build automated responses with Python, PowerShell, and REST APIs, and measure outcomes like time to triage and analyst hours saved, helping strengthen defense for