Cyber Defense Analyst

Ford Motor; Dearborn (MI); Hybrid; USD 85,000 - 193,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Paid parental leave

Tuition assistance

Vehicle discount program

Paid time off

Job summary

Ford Motor Company in Michigan is seeking a Cyber Defense Center Detection Analyst focused on initial threat triage and rapid incident assessment. You will determine severity, initiate timely responses, and escalate for remediation, with a hybrid on-site schedule in Southeast Michigan.

You’ll perform triage of incidents (phishing, malware, intrusions), conduct daily analyses using SIEM/EDR/IDS, and collaborate with internal and customer teams to contain threats.

Qualifications

• Bachelor’s degree in a computer related field.
• 2+ years of experience with SIEM tools and/or reviewing system log files, data correlation, and analysis (i.e. firewall, network flow, system logs, IDS)
• 2+ years of experience in customer service including the resolution of escalations, incident handling, and response
• In depth knowledge of servers, clients, various computer peripherals, network and/or storage technologies with various operating systems including Windows, Linux, and Mac
• Experience in a fast paced, high stress, support environment, able to work with a sense of urgency and attention to detail
• Must work well with others including peers and end-users
• Strong interest in cyber security with an eagerness and willingness to learn
• Strong deductive reasoning, critical and analytical thinking, problem solving, and prioritization skills
• Disciplined approach utilized when completing work and adhering to procedure
• Strong oral and written communications skills – able and willing to communicate technical items in non-technical terms
• Demonstrate high level of independent initiative, drive for results and commitment to integrity
• Ability to concurrently work on multiple assignments/projects and complete on schedule with high quality

Responsibilities

• Perform initial triage of various security incidents to determine if a threat applies to Ford including phishing, malicious software, hostile probes, information theft, and misuse of computing facilities
• Conduct daily analysis on the aforementioned incidents using a range of tools such as SIEM, EDR, IDS/IPS, Cloud, and Sandbox analysis
• Collaborate with internal and customer teams to investigate and contain incidents
• Respond to cyber security queries received from Ford personnel
• Adhere to various playbooks/procedures to provide consistent and repeatable methods to resolve security incidents
• Effectively document investigation details for both technical and non-technical audiences
• Recognize attacker Tools, Techniques, and Procedures (TTPs) and Indicator of Compromises (IOCs) that apply to current and future investigations
• Support Shift Lead rotation at least once per calendar quarter
• Keeping up-to-date with emerging cybersecurity threats to proactively prevent potential attacks and improve Ford’s cyber security posture
• Leverage AI-driven threat detection and analysis tools to enhance triage accuracy and accelerate identification of emerging attack patterns

Skills

SIEM tools

Log file analysis

Customer service

Cross-team collaboration

Windows/Linux/Mac

Analytical thinking

Communication skills

Prioritization

Attention to detail

Independent initiative

Education

Bachelor’s degree in a computer related field

Tools

Python

PowerShell

Bash

SQL

GCP

Azure

Job description

This position is for a Cyber Defense Center (CDC) Detection Analyst specializing in initial threat triage. A Detection Analyst involves swiftly assessing and prioritizing security incidents to determine their severity and potential impact. You will be responsible for promptly identifying and investigating various threats, initiating timely response actions, and escalating to appropriate teams for further investigation and/or remediation.

This role is hybrid, with on-site work in Southeast Michigan. Additionally, candidates must be willing to work at least 1 weekend per calendar quarter. For those weeks, only when you’re Shift Lead, you work 11am-8pm shift during Eastern Daylight Savings time and 10am-7pm shift during Eastern Standard time.

Qualifications

Qualifications:

• Bachelor’s degree in a computer related field
• 2+ years of experience with SIEM tools and/or reviewing system log files, data correlation, and analysis (i.e. firewall, network flow, system logs, IDS)
• 2+ years of experience in customer service including the resolution of escalations, incident handling, and response
• In depth knowledge of servers, clients, various computer peripherals, network and/or storage technologies with various operating systems including Windows, Linux, and Mac
• Experience in a fast paced, high stress, support environment, able to work with a sense of urgency and attention to detail
• Must work well with others including peers and end-users
• Strong interest in cyber security with an eagerness and willingness to learn
• Strong deductive reasoning, critical and analytical thinking, problem solving, and prioritization skills
• Disciplined approach utilized when completing work and adhering to procedure
• Strong oral and written communications skills – able and willing to communicate technical items in non-technical terms
• Demonstrate high level of independent initiative, drive for results and commitment to integrity
• Ability to concurrently work on multiple assignments/projects and complete on schedule with high quality

Preferred Qualifications:

• 2+ years of Cyber Security experience
• 2+ years Cloud experience in Google Cloud Platform (GCP) or Microsoft Azure
• Experience applying Artificial Intelligence (AI) and Machine Learning (ML) to improve processes, decision-making, or analysis within your current job responsibilities
• Familiar with Ford Computing Infrastructure and application development life cycle (SDM)
• Scripting abilities (Python, PowerShell, Bash/Shell, SQL)
• GIAC, CEH, CISSP or other security credentials

As an established global company, we offer the benefit of choice. You can choose what your Ford future will look like: will your story span the globe, or keep you close to home? Will your career be a deep dive into what you love, or a series of new teams and new skills? Will you be a leader, a changemaker, a technical expert, a culture builder…or all of the above? No matter what you choose, we offer a work life that works for you, including:

• Immediate medical, dental, vision, and prescription drug coverage
• Paid parental leave, new parent ramp-up programs, subsidized back-up child care and more
• Family building benefits including adoption and surrogacy expense reimbursement, fertility treatments and more
• Vehicle discount program for employees and family members and management leases
• Tuition assistance
• Established and active employee resource groups
• Paid time off for individual and team community service
• Generous vacation time, sick/personal time, and paid holidays, including between Christmas Eve and New Year’s Day

This position is a salary grade 6-8 and ranges from $85,400-$192,900.

Final determination of salary grade will be based on candidate's skills and experience, and base salary will be set within the applicable range according to job scope, responsibility and competitive market value.

For more information on salary and benefits, click here: https://fordcareers.co/GSR

Visa sponsorship is not available for this position.

Candidates for positions with Ford Motor Company must be legally authorized to work in the United States. Verification of employment eligibility will be required at the time of hire.

We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, age, sex, national origin, sexual orientation, gender identity, disability status or protected veteran status. In the United States, if you need a reasonable accommodation for the online application process due to a disability, please call 1-888-336-0660.

This position is hybrid with a requirement to be onsite four or more days per week.

Responsibilities

• Perform initial triage of various security incidents to determine if a threat applies to Ford including phishing, malicious software, hostile probes, information theft, and misuse of computing facilities
• Conduct daily analysis on the aforementioned incidents using a range of tools such as SIEM, EDR, IDS/IPS, Cloud, and Sandbox analysis
• Collaborate with internal and customer teams to investigate and contain incidents
• Respond to cyber security queries received from Ford personnel
• Adhere to various playbooks/procedures to provide consistent and repeatable methods to resolve security incidents
• Effectively document investigation details for both technical and non-technical audiences
• Recognize attacker Tools, Techniques, and Procedures (TTPs) and Indicator of Compromises (IOCs) that apply to current and future investigations
• Support Shift Lead rotation at least once per calendar quarter
• Keeping up-to-date with emerging cybersecurity threats to proactively prevent potential attacks and improve Ford’s cyber security posture
• Leverage AI-driven threat detection and analysis tools to enhance triage accuracy and accelerate identification of emerging attack patterns