Threat Detection Analyst (Expert)

Huntington National Bank

Minnetonka (MN)

Hybrid

USD 70,000 - 140,000

Full time

10 days ago

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Health insurance coverage

Wellness program

Life and disability insurance

Retirement savings plan

Paid leave programs

Paid holidays and PTO

Job summary

Huntington National Bank is seeking a Threat Detection Analyst Expert to lead design, deployment, and tuning of detections across SIEM, XDR, EDR, cloud, and network platforms. You will collaborate with Incident Response, Cybersecurity Operations, Threat Intelligence, Security Engineering, and IT Operations to improve visibility and reduce gaps.

The role emphasizes development of high-fidelity detections, validation through simulations, and ongoing improvement of detection content.

Qualifications

High School Diploma or 8+ years of equivalent experience.
5+ years of experience in Cybersecurity.
1+ years data analytics experience within the threat detection space.

Responsibilities

Provide leadership, mentorship, and training opportunities for junior Threat Detection Analysts.
Design, develop, test, deploy, and maintain threat detections across SIEM, XDR, EDR, cloud, and network security platforms.
Conduct detection engineering activities aligned to the MITRE ATT&CK framework and known adversary behaviors.
Analyze threat intelligence, attack techniques, and emerging threats to identify new detection opportunities.
Develop and maintain detection use cases, analytics, correlation rules, anomaly detections, and behavioral detections.
Perform detection validation through threat simulations, purple team exercises, adversary emulation, and attack replay testing.

Skills

Threat detection

Threat analytics

Detection engineering

MITRE ATT&CK

Security telemetry

Threat hunting

Communication

Education

High School Diploma or equivalent

Bachelor's degree or 4+ years experience

Tools

Palo Alto Cortex XSIAM

Microsoft Sentinel

Splunk

Microsoft Defender XDR

KQL

SPL

XQL

SQL

Python

PowerShell

Bash

Job description

Description

Columbus, OH
Pittsburgh, PA
Atlanta, GA

Office Locations

This position is an onsite position and is available to be filled at any Huntington Corporate office location:

Detroit, MI
Dallas, TX
Columbus, OH
Pittsburgh, PA
Minotonka, MN
Atlanta, GA

Threat Detection Analyst (Expert)

The Threat Detection Analyst Expert develops, tunes, validates, and maintains threat detection content across the organization's security platforms. This role leverages threat intelligence, adversary tradecraft, attack simulations, and data analytics to identify detection opportunities and improve visibility into malicious activity. Analyze security telemetry, threat trends, and attack techniques to create high-fidelity detections that identify threats across the enterprise.

The Threat Detection Analyst Expert works closely with Incident Response, Cybersecurity Operations, Threat Intelligence, Security Engineering, and IT Operations teams to improve detection coverage, reduce detection gaps, and enhance the organization's ability to identify adversary behavior. This role is responsible for the full detection lifecycle, including design, testing, deployment, tuning, validation, and continuous improvement of threat detections.

Threat Detection Analyst Responsibilities

Provide leadership, mentorship, and training opportunities for junior Threat Detection Analysts.
Design, develop, test, deploy, and maintain threat detections across SIEM, XDR, EDR, cloud, and network security platforms.
Conduct detection engineering activities aligned to the MITRE ATT&CK framework and known adversary behaviors.
Analyze threat intelligence, attack techniques, and emerging threats to identify new detection opportunities.
Develop and maintain detection use cases, analytics, correlation rules, anomaly detections, and behavioral detections.
Perform detection validation through threat simulations, purple team exercises, adversary emulation, and attack replay testing.
Conduct detection gap assessments and identify areas requiring additional visibility or telemetry.
Continuously tune and optimize detection logic to improve fidelity and reduce false positives and false negatives.
Create and maintain detection documentation, testing procedures, and coverage mappings.
Analyze security telemetry and log sources to identify opportunities for improved monitoring coverage.
Develop content and requirements for new log sources, telemetry collection, and data quality improvements.
Partner with Incident Response teams to improve detection content based on investigations and lessons learned.
Collaborate with Threat Intelligence teams to operationalize indicators, emerging threats, and attacker TTPs.
Maintain awareness of emerging attack techniques, cybersecurity trends, and advancements in detection methodologies.
Measure and report on detection health, coverage effectiveness, and detection performance metrics.
Perform other duties as assigned.

Basic Qualifications

High School Diploma or 8+ additional years of equivalent experience.
5+ years of experience in Cybersecurity.
1+ years data analytics experience within the threat detection space.

Preferred Qualifications

Bachelor's degree or 4+ additional years of equivalent experience.
Professional experience with Palo Alto Cortex XSIAM, Microsoft Sentinel, Splunk, Microsoft Defender XDR, or similar detection platforms.
Strong experience developing, testing, deploying, and maintaining threat detections across enterprise security technologies.
Experience creating detection logic based on MITRE ATT&CK techniques, threat intelligence, and real-world adversary behaviors.
Experience conducting detection validation using attack simulation, adversary emulation, or purple team methodologies.
Experience tuning detections to reduce false positives while maintaining detection efficacy.
Ability to conduct detection coverage analysis and detection gap assessments.
Familiarity with detection-as-code methodologies and version-controlled detection development processes.
Experience writing and optimizing KQL, SPL, XQL, SQL, or similar analytics languages.
Strong understanding of attacker tactics, techniques, and procedures (TTPs).
Experience working with large-scale security telemetry and log analytics.
Knowledge of common attack vectors including phishing, credential theft, ransomware, cloud attacks, insider threats, and lateral movement.
Familiarity with threat hunting concepts and the conversion of hunt hypotheses into operational detections.
Understanding of Windows, Linux, macOS, Active Directory, Azure AD/Entra ID, and cloud security telemetry.
Experience with scripting and automation using Python, PowerShell, Bash, or similar languages.
Knowledge of common network protocols such as HTTP/S, DNS, SMTP, SSH, LDAP, and Kerberos.
Understanding of cybersecurity frameworks including MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and detection engineering best practices.
Strong analytical, communication, presentation, and problem-solving skills.

Occasional travel may be required.

Exempt Status: Yes = not eligible for overtime pay; No = eligible for overtime pay.

Workplace Type

Office. Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds: in‑office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.

Compensation Range

$70,000 - $140,000 Annual Salary

The compensation range represents the anticipated low and high end of the base compensation range for this position. Actual compensation will vary based on various factors including but not limited to location, experience, and education. Colleagues in this position are also eligible to participate in an applicable incentive compensation plan. In addition, Huntington provides a variety of benefits to colleagues: