Cyber Threat Analyst (Detection & Automation Engineering)

phia LLC; Virginia; Hybrid; USD 110,000 - 165,000; Full time

Benefits offered by this job

Medical Insurance

Vision Insurance

Life Insurance

Disability Insurance

401k with match

Paid Holidays

Paid Time Off

Tuition Assistance

Job summary

phia LLC is seeking a Cyber Threat Analyst (Detection & Automation Engineering) to support cyber threat analysis, detection engineering, and operations at a federal agency. Remote work flexibility is offered; US citizenship and Public Trust clearance are required.

You will design automated detections and integrations across SIEM/EDR/SOAR, strengthen detection capabilities, and collaborate with SOC, threat intel, and IR teams.

Qualifications

• Deep experience with cyber threat analysis workflows and detection engineering.
• Strong capabilities in security automation and SI/ML tooling.
• Extensive knowledge of SOC operations, threat intel, and incident response.

Responsibilities

• Design, implement, and maintain automated security detections and integration across enterprise monitoring tools.
• Improve threat detection and response through engineering and automation.
• Build automation workflows to accelerate detection and response.
• Integrate security technologies (SIEM, EDR, SOAR) into a cohesive architecture.
• Translate security needs into technical requirements and implementable solutions.
• Test, validate, and iteratively improve detections and workflows.
• Analyze telemetry to identify anomalies and gaps, propose enhancements.
• Create and maintain technical docs, SOPs, and runbooks for operations.
• Coordinate with SOC, threat intel, and IR teams to align detections with priorities.
• Evaluate emerging security capabilities to enhance detection effectiveness.

Skills

SOAR platforms

AI/SI security

SOC operations

Threat intelligence

Incident response

Network protocols

Windows/Linux/Unix

Cloud platforms

Security architecture

Programming/Python

API integration

Detection engineering

Automation/orchestration

Education

Bachelor's degree

7–17 years experience substitution

Tools

SentinelOne Singularity

Splunk Enterprise Security

Splunk SOAR

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Cyber Threat Analyst (Detection & Automation Engineering)

Direct Labor US

2 days ago Requisition ID: 1054

phia is hiring a Cyber Threat Analyst (Detection & Automation Engineering) to support cyber threat analysis and detection engineering and operations at a large Federal agency. The role requires close collaboration with security operations, threat intelligence, and incident response stakeholders, along with strong configuration development, testing, and documentation practices. The ideal candidate will have deep experience with cybersecurity threats and analysis workflows, detection capabilities and methodologies, and automation platforms and tools.

This position offers REMOTE work flexibility. Qualified candidates will be U.S. Citizens and located in the United States, able to achieve Public Trust security vetting approval.

What You’ll Do:

• Design, implement, and maintain automated, Artificial/Super Intelligence (AI/SI) enabled security detection, integration capabilities across enterprise security monitoring technologies.
• Strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows.
• Build automation and integration workflows to improve detection and response.
• Security Platform Integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
• Requirements-to-Implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
• Testing & Validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
• Security Data Analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
• Documentation & Sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations. Provide status and activity reporting and plans to management.
• Cross-Functional Coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
• Emerging Capability Evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.

Who You Are / What You Bring:

• Significant depth and expertise in:
  • SOAR Platforms and Capabilities (SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, Splunk SOAR)
  • Artificial Intelligence (AI) / Super Intelligence (SI) Security
  • SOC operations and processes
  • Threat intelligence lifecycle and analysis
  • Incident response methodologies
  • Network protocols and architecture
  • Operating systems (Windows/Linux/Unix)
  • Cloud platforms (AWS/Azure/GCP)
  • Security architecture and design
  • Programming/scripting (Python, PowerShell, Bash)
  • API integration and development
  • Detection engineering methodologies
  • Security automation and orchestration concepts
• Familiarly with Frameworks, Standards & Compliance:
  • NIST SP 800-53 Security Controls, CIS Controls, MITRE ATT&CK Framework
  • CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars and Federal Cybersecurity Directives, Privacy Act
• Familiarity and experience in:
  • Malware analysis
  • Digital forensics analysis and procedures
  • Risk assessment methodologies
• Ability to work independently, work in a fast-paced environment, and attention to detail.
• Excellent communication, organizational, and interpersonal skills

Required Education + Experience:

(Multiple levels of seniority will be considered for this position)

• Bachelors degree + 3 to 13 years of experience in cybersecurity analysis and engineering (cyber threat analysis, intrusion analysis, detection engineering, etc.). Four additional years of experience can be substituted in lieu of a degree (7 – 17 years of experience).
• Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell, similar)

Required Certifications:

• CompTIA Security+ (or equivalent baseline cybersecurity certification)
• At least one of:
  • GIAC Certified Intrusion Analyst (GCIA) or GX-IA
  • GIAC Certified Incident Handler (GCIH) or GX-IH
  • CompTIA CySA+ Cybersecurity Analyst

Desired Certifications (or similar):

• CompTIA SecAI+
• GIAC AI Security Automation Engineer (GASAE)
• Certified Information Systems Security Professional (CISSP)

Security Clearance/Vetting:

• Ability to obtain Public Trust clearance

WORK LOCATION:Remote
TRAVEL:N/A
TELEWORK ELIGIBILITY:Yes
SECURITY REQUIREMENTS:Public Trust

Who We Are

phia LLC ("phia") is a Northern Virginia based, small business established in 2011 with focus in Cyber Intelligence, Cyber Security/Defense, Intrusion Analysis & Incident Response, Cyber Architecture & Capability Analysis, Cyber Policy & Strategy, Information Assurance/Security, Compliance, Certification & Accreditation, Communications Security, Traditional Security, and Facilities Security. phia also provides cyber operations support functions such as: Program and Process Management, Engineering, Development, and Systems Administration that allows for Cyber Operations to efficiently integrate our customer’s missions and objectives. phia supports various agencies and offices within the Department of Defense (DoD), Federal government, and private/commercial entities.

phia offers excellent benefits to enhance work-life balance, including the following:

• Medical Insurance
• Vision Insurance
• Life Insurance
• Short Term & Long Term Disability
• 401k Retirement Savings Plan with Company Match
• Paid Holidays
• Paid Time Off (PTO)
• Tuition and Professional Development Assistance

phia does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity, or any other reason prohibited by law in the provision of employment opportunities and benefits.