AI-Powered Security Analyst: Detection & Investigation

Artemis Security; New York (NY); On-site; USD 100,000 - 140,000; Full time

Job summary

Artemis Security is seeking a Security Analyst to review real cases across customer environments and improve AI-assisted detection logic. You’ll operate at the intersection of hands-on SOC work and AI-enabled security operations, gaining deep expertise in cloud, identity, and SaaS threats while shaping detection content and investigation workflows.

The role combines case triage, verdict writing, and collaboration with detection engineers to reduce noise and surface critical threats.

Qualifications

• 2–3+ years in a SOC, MSSP, or MDR environment.
• Experience triaging and investigating alerts in on‑prem and cloud environments (AWS CloudTrail, Okta, Entra ID, GSuite).
• Familiarity with MITRE ATT&CK techniques.
• Ability to write clear, concise case verdicts and communicate findings to technical and non-technical audiences.
• Strong attention to detail and an instinct for separating signal from noise.

Responsibilities

• Review and triage security cases across cloud, identity, endpoint, and SaaS environments.
• Recommend outcomes with evidence for reports and product improvement loops.
• Build and refine detections to improve signal quality and reduce noise.
• Fix misfiring detections and maintain the detection library from triage to deployment.
• Conduct threat hunting to identify attacker activity that automated detections may miss.
• Investigate escalated incidents and piece together attacker timelines and lateral movement.

Skills

SOC operations

Threat hunting

Log analysis

Incident investigation

Communication

Attention to detail

Tools

Sigma rules

YARA-L

KQL

SPL

SIEM

EDR

SOAR

Job description

Artemis Security is seeking a Security Analyst to review real cases across customer environments and improve AI-assisted detection logic. You’ll operate at the intersection of hands-on SOC work and AI-enabled security operations, gaining deep expertise in cloud, identity, and SaaS threats while shaping detection content and investigation workflows.

The role combines case triage, verdict writing, and collaboration with detection engineers to reduce noise and surface critical threats.