Cyber Security Operations Center Analyst / AI-Automation Engineer

Micron; Boise (ID); Hybrid; USD 110,000 - 160,000; Full time

Job summary

Micron Technology in Boise, Idaho seeks a CSOC Analyst / AI-Automation Engineer to advance security operations, threat investigation, and AI-enabled automation. This hybrid role blends hands-on defense with engineering of reusable playbooks and automation to improve detection and response.

You will design AI-assisted capabilities, build automated responses with Python, PowerShell, and REST APIs, and measure outcomes like time to triage and analyst hours saved, helping strengthen defense for

Responsibilities

• Investigate, triage, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments.
• Hunt for malicious or anomalous activity, and correlate telemetry across security platforms to determine scope, impact, and the right response.
• Implement and continuously improve incident response and investigation playbooks.
• Partner with threat intelligence, detection engineering, incident response, vulnerability management, and other security teams on complex investigations.
• Develop and tune detections based on emerging threats, attack techniques, intelligence, and lessons learned from investigations.
• Identify detection gaps and recommend improvements to telemetry, correlation, and response logic.
• Translate analyst knowledge and investigation techniques into repeatable detection and response capabilities.
• Use frameworks such as MITRE ATT&CK to structure detection and threat-hunting coverage.
• Identify repetitive analyst work and decide whether to automate, eliminate, redesign, or keep it manual, based on volume, risk, and how often the process changes.
• Build scripts, playbooks, and integrations with Python, PowerShell, REST APIs, SOAR, and workflow platforms that connect security tools, telemetry sources, and case-management systems.
• Engineer them to production standard, with error handling, retries, idempotent actions, structured logging, and alerts when an automation fails or silently stops.
• Add proportionate safeguards to automated response: human approval for disruptive actions such as host containment, account disablement, or mailbox purges, plus exclusion lists, action limits, and tested rollback.
• Manage automation as code, with source control, peer review, non-production testing, and change-managed promotion.
• Use least-privilege service identities and managed secrets, and maintain credentials and API permissions over their full lifecycle.
• Own what you build by documenting it, monitoring its health, and maintaining it as upstream tools change.
• Measure outcomes such as analyst hours returned, time to triage and respond, consistency, and error rates.
• Focus especially on the risk that automation might close cases needing advancement.
• Design, build, and operate AI agents that support investigation, enrichment, threat analysis, and response by querying SIEM, EDR, identity, threat intelligence, and case-management systems.
• Build the agent tools with MCP and platform APIs, using narrowly scoped, least-privilege access and separating read-only from state-changing actions.
• Match autonomy to each use case so that AI informs judgment while policy-based controls govern high-impact decisions.
• Encode analyst expertise as reusable instructions and skills grounded in trusted sources such as runbooks and prior cases.
• Defend against prompt injection from untrusted content.
• Evaluate agents against historical analyst ground truth and run them in shadow mode before granting autonomy.
• Log prompts, tool calls, and evidence so every AI-influenced action is auditable.
• Require cited evidence and validation before AI analysis drives decisions.
• Look for places where AI can augment analyst judgment, not just automate existing processes.
• Treat every investigation as an opportunity to improve the broader defense capability.
• Document investigation logic so that analyst knowledge can be converted into detections, automation, pl

Job description

Our vision is to transform how the world uses information to enrich life for all .

Micron Technology is a world leader in innovating memory and storage solutions that accelerate the transformation of information into intelligence, inspiring the world to learn, communicate and advance faster than ever.

The Cyber Security Operations Center (CSOC) Analyst / AI-Automation Engineer is a hybrid cybersecurity role that combines security operations, threat investigation, detection engineering, and AI-enabled automation development. You will investigate and respond to cyber threats. You will also improve how Cyber Defense operates by automating repetitive analyst workflows, engineering automated responses, strengthening detections, and building AI-assisted capabilities that increase speed, consistency, and scale.

This is not a traditional SOC analyst role. When you find a repetitive process, you will ask whether it can be automated. When you find a detection gap, you will help engineer the fix. When you develop an effective investigation technique, you will turn it into a reusable playbook, automation, or AI-enabled capability. Success means handling security events well and leaving the Cyber Defense organization more capable after every investigation: defend today while engineering a better defense for tomorrow.

This role is part of the CSOC's move toward new hybrid roles and supports a 16x5 operating schedule.

Responsibilities:

Cyber Defense Operations:

Investigate, triage, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments. Hunt for malicious or anomalous activity, and correlate telemetry across security platforms to determine scope, impact, and the right response. Implement and continuously improve incident response and investigation playbooks. Partner with threat intelligence, detection engineering, incident response, vulnerability management, and other security teams on complex investigations.

Detection & Response Engineering:

Develop and tune detections based on emerging threats, attack techniques, intelligence, and lessons learned from investigations. Identify detection gaps and recommend improvements to telemetry, correlation, and response logic. Translate analyst knowledge and investigation techniques into repeatable detection and response capabilities. Use frameworks such as MITRE ATT&CK to structure detection and threat-hunting coverage.

Automation & Engineering:

Identify repetitive analyst work and decide whether to automate, eliminate, redesign, or keep it manual, based on volume, risk, and how often the process changes. Build scripts, playbooks, and integrations with Python, PowerShell, REST APIs, SOAR, and workflow platforms that connect security tools, telemetry sources, and case-management systems. Engineer them to production standard, with error handling, retries, idempotent actions, structured logging, and alerts when an automation fails or silently stops. Add proportionate safeguards to automated response: human approval for disruptive actions such as host containment, account disablement, or mailbox purges, plus exclusion lists, action limits, and tested rollback. Manage automation as code, with source control, peer review, non-production testing, and change-managed promotion. Use least-privilege service identities and managed secrets, and maintain credentials and API permissions over their full lifecycle. Own what you build by documenting it, monitoring its health, and maintaining it as upstream tools change. Measure outcomes such as analyst hours returned, time to triage and respond, consistency, and error rates. Focus especially on the risk that automation might close cases needing advancement.

AI-Enabled Security Operations:

Design, build, and operate AI agents that support investigation, enrichment, threat analysis, and response by querying SIEM, EDR, identity, threat intelligence, and case-management systems. Build the agent tools with MCP and platform APIs, using narrowly scoped, least-privilege access and separating read-only from state-changing actions. Match autonomy to each use case so that AI informs judgment while policy-based controls govern high-impact decisions. Encode analyst expertise as reusable instructions and skills grounded in trusted sources such as runbooks and prior cases. Defend against prompt injection from untrusted content. Evaluate agents against historical analyst ground truth and run them in shadow mode before granting autonomy. Log prompts, tool calls, and evidence so every AI-influenced action is auditable. Require cited evidence and validation before AI analysis drives decisions. Look for places where AI can augment analyst judgment, not just automate existing processes.

Continuous Improvement:

Treat every investigation as an opportunity to improve the broader defense capability. Document investigation logic so that analyst knowledge can be converted into detections, automation, pl