Threat Detection Analyst (Expert)

0101 The Huntington National Bank; United States; On-site; USD 70,000 - 140,000; Full time

Benefits offered by this job

Health insurance coverage

Wellness program

Life and disability insurance

Retirement savings plan

Paid leave programs

Paid holidays

Paid time off (PTO)

Job summary

Huntington National Bank seeks an Expert Threat Detection Analyst to lead detection engineering across SIEM, XDR, EDR, cloud, and network security platforms. You will mentor juniors, develop and validate detections, and collaborate with Incident Response and Threat Intelligence teams.

The role focuses on mature detection content, reducing false positives and expanding telemetry. Onsite office locations include Detroit, Dallas, Columbus, Pittsburgh, Minnetonka, and Atlanta.

Qualifications

• 5+ years in Cybersecurity.
• Experience with detection engineering across enterprise security tech.

Responsibilities

• Lead, mentor, and train junior Threat Detection Analysts.
• Design, test, deploy, and maintain threat detections across SIEM/XDR/EDR/cloud platforms.
• Analyze threat intel and adversary behaviors to identify new detections.
• Develop detection use cases, analytics, and rules.
• Collaborate with Incident Response and Threat Intelligence teams.

Skills

Threat detection

SIEM/XDR/EDR

MITRE ATT&CK

Python scripting

Education

Bachelor's degree or 4+ years

Tools

Splunk

Microsoft Defender XDR

Palo Alto Cortex XSIAM

Job description

This position is an onsite position and is available to be filled at any Huntington Corporate office location: Detroit, MI; Dallas, TX; Columbus, OH; Pittsburgh, PA; Minnetonka, MN; Atlanta, GA.

Threat Detection Analyst (Expert)

Threat Detection Analyst Responsibilities

• Provide leadership, mentorship, and training opportunities for junior Threat Detection Analysts.
• Design, develop, test, deploy, and maintain threat detections across SIEM, XDR, EDR, cloud, and network security platforms.
• Conduct detection engineering activities aligned to the MITRE ATT&CK framework and known adversary behaviors.
• Analyze threat intelligence, attack techniques, and emerging threats to identify new detection opportunities.
• Develop and maintain detection use cases, analytics, correlation rules, anomaly detections, and behavioral detections.
• Perform detection validation through threat simulations, purple team exercises, adversary emulation, and attack replay testing.
• Conduct detection gap assessments and identify areas requiring additional visibility or telemetry.
• Continuously tune and optimize detection logic to improve fidelity and reduce false positives and false negatives.
• Create and maintain detection documentation, testing procedures, and coverage mappings.
• Analyze security telemetry and log sources to identify opportunities for improved monitoring coverage.
• Develop content and requirements for new log sources, telemetry collection, and data quality improvements.
• Partner with Incident Response teams to improve detection content based on investigations and lessons learned.
• Collaborate with Threat Intelligence teams to operationalize indicators, emerging threats, and attacker TTPs.
• Maintain awareness of emerging attack techniques, cybersecurity trends, and advancements in detection methodologies.
• Measure and report on detection health, coverage effectiveness, and detection performance metrics.
• Perform other duties as assigned.

Basic Qualifications

• High School Diploma or 8+ additional years of equivalent experience.
• 5+ years of experience in Cybersecurity.
• 1+ years data analytics experience within the threat detection space.

Preferred Qualifications

• Bachelor's degree or 4+ additional years of equivalent experience.
• Professional experience with Palo Alto Cortex XSIAM, Microsoft Sentinel, Splunk, Microsoft Defender XDR, or similar detection platforms.
• Strong experience developing, testing, deploying, and maintaining threat detections across enterprise security technologies.
• Experience creating detection logic based on MITRE ATT&CK techniques, threat intelligence, and real-world adversary behaviors.
• Experience conducting detection validation using attack simulation, adversary emulation, or purple team methodologies.
• Experience tuning detections to reduce false positives while maintaining detection efficacy.
• Ability to conduct detection coverage analysis and detection gap assessments.
• Familiarity with detection-as-code methodologies and version-controlled detection development processes.
• Experience writing and optimizing KQL, SPL, XQL, SQL, or similar analytics languages.
• Strong understanding of attacker tactics, techniques, and procedures (TTPs).
• Experience working with large-scale security telemetry and log analytics.
• Knowledge of common attack vectors including phishing, credential theft, ransomware, cloud attacks, insider threats, and lateral movement.
• Familiarity with threat hunting concepts and the conversion of hunt hypotheses into operational detections.
• Understanding of Windows, Linux, macOS, Active Directory, Azure AD/Entra ID, and cloud security telemetry.
• Experience with scripting and automation using Python, PowerShell, Bash, or similar languages.
• Knowledge of common network protocols such as HTTP/S, DNS, SMTP, SSH, LDAP, and Kerberos.
• Understanding of cybersecurity frameworks including MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and detection engineering best practices.
• Strong analytical, communication, presentation, and problem-solving skills.

Occasional travel may be required (<10%).

Exempt Status: (Yes = not eligible for overtime pay) (No = eligible for overtime pay) Yes

Workplace Type: Office

Our Approach to Office Workplace Type

Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds: in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.

Compensation Range: $70,000 - $140,000 Annual Salary

The compensation range represents the anticipated low and high end of the base compensation range for this position. Actual compensation will vary based on various factors including but not limited to location, experience, and education.

Colleagues in this position are also eligible to participate in an applicable incentive compensation plan.

Benefits

• health insurance coverage
• wellness program
• life and disability insurance
• retirement savings plan
• paid leave programs
• paid holidays
• paid time off (PTO)

Huntington is an Equal Opportunity Employer.

Tobacco-Free Hiring Practice: Visit Huntington's Career Web Site for more details.

Welcome to Huntington! At Huntington, we look out for people. From reinventing banking with game-changing innovations to building an internal culture that creates lifelong bonds, together, we can make people’s lives better. And amazing things happen when we look out for each other. We prove it every day. Whether it’s helping a colleague or collaborating on a new tool that will revolutionize the way people save money, our actions can have a huge impact. Our colleagues look out for people with a Can-Do Attitude, Service Heart and Forward Thinking. Those are our values—simple but powerful. Each of them pushes us do the right thing, to do right by people. Because people are what matter. If that sounds like you, we hope you’ll apply to join our team. If you’d like to learn more about how Huntington looks out for people, visit https://www.huntington.com/lookingout

We endeavor to make this site accessible to any and all users. If you would like to contact us regarding the accessibility of this site or if you require a reasonable accommodation to apply for a job or to perform the essential functions of the job, please send an email to [e-mail] Reasonable Accommodations Various methods will be used throughout the recruitment process to verify candidate authenticity. Any interviews conducted virtually must be joined from a distraction-free environment, with the candidate on camera and without the use of virtual backgrounds.