Cyber Defense Analyst

Ford • Dearborn, MI

1d • $85,400 - $192,900 • Hybrid

About The Position

This is a Cyber Defense Center (CDC) Detection Analyst role focused on initial threat triage. The analyst swiftly assesses and prioritizes security incidents to determine severity and potential impact, identifies and investigates threats, initiates timely response actions, and escalates incidents to appropriate teams for further investigation or remediation. The position is hybrid and requires on-site work in Southeast Michigan at least four days per week.

The analyst conducts initial triage and daily analysis of security incidents, collaborates with internal and customer teams to investigate and contain incidents, responds to cybersecurity queries from Ford personnel, and follows playbooks and procedures to resolve incidents consistently. The role also involves documenting investigations for technical and non-technical audiences, recognizing attacker tools, techniques, procedures, and indicators of compromise, keeping current on emerging threats, and using AI-driven detection and analysis tools to improve triage accuracy and identify emerging attack patterns.

The position supports a Shift Lead rotation at least once per calendar quarter and requires working at least one weekend per calendar quarter. During weeks when serving as Shift Lead, the shift is 11 a.m.–8 p.m. during Eastern Daylight Savings Time and 10 a.m.–7 p.m. during Eastern Standard Time.

Requirements

• Bachelor's degree in a computer-related field.
• At least 2 years of experience with SIEM tools and/or reviewing system log files, data correlation, and analysis, such as firewall, network flow, system logs, or IDS.
• At least 2 years of customer service experience, including resolution of escalations, incident handling, and response.
• In-depth knowledge of servers, clients, computer peripherals, network and/or storage technologies, and operating systems including Windows, Linux, and Mac.
• Experience in a fast-paced, high-stress support environment, with a sense of urgency and attention to detail.
• Ability to work well with peers and end users.
• Strong interest in cybersecurity and eagerness and willingness to learn.
• Strong deductive reasoning, critical and analytical thinking, problem-solving, and prioritization skills.
• Disciplined approach to completing work and adhering to procedures.
• Strong oral and written communication skills, including the ability and willingness to explain technical matters in non-technical terms.
• High level of independent initiative, drive for results, and commitment to integrity.
• Ability to work concurrently on multiple assignments or projects and complete them on schedule and with high quality.
• Willingness to work at least one weekend per calendar quarter.

Nice To Haves

• At least 2 years of cybersecurity experience.
• At least 2 years of cloud experience in Google Cloud Platform (GCP) or Microsoft Azure.
• Experience applying artificial intelligence (AI) and machine learning (ML) to improve processes, decision-making, or analysis in current job responsibilities.
• Familiarity with Ford Computing Infrastructure and the application development life cycle (SDM).
• Scripting ability in Python, PowerShell, Bash/Shell, or SQL.
• GIAC, CEH, CISSP, or other security credentials.

Responsibilities

• Perform initial triage of security incidents, including phishing, malicious software, hostile probes, information theft, and misuse of computing facilities, to determine whether threats apply to Ford.
• Conduct daily incident analysis using tools such as SIEM, EDR, IDS/IPS, cloud tools, and sandbox analysis.
• Collaborate with internal and customer teams to investigate and contain incidents.
• Respond to cybersecurity queries from Ford personnel.
• Follow playbooks and procedures to resolve security incidents consistently and repeatably.
• Document investigation details effectively for technical and non-technical audiences.
• Recognize attacker tools, techniques, and procedures (TTPs) and indicators of compromise (IOCs) relevant to current and future investigations.
• Support the Shift Lead rotation at least once per calendar quarter.
• Keep up to date with emerging cybersecurity threats to help prevent attacks and improve Ford's cybersecurity posture.
• Leverage AI-driven threat detection and analysis tools to enhance triage accuracy and accelerate identification of emerging attack patterns.

Benefits

• Immediate medical, dental, vision, and prescription drug coverage.
• Paid parental leave, new parent ramp-up programs, and subsidized back-up child care.
• Family-building benefits, including adoption and surrogacy expense reimbursement and fertility treatments.
• Vehicle discount program for employees and family members and management leases.
• Tuition assistance.
• Established and active employee resource groups.
• Paid time off for individual and team community service.
• Generous vacation time, sick/personal time, and paid holidays, including between Christmas Eve and New Year's Day.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level