Cyber Security Incident Response Team Analyst

Stellantis•Auburn Hills, MI

About The Position

The Cyber Security Incident Response Team (CSIRT) Analyst monitors, detects, analyzes, and responds to cybersecurity threats across the enterprise. The role focuses on proactive threat detection, incident investigation, SIEM monitoring, threat hunting, and coordination with global security and infrastructure teams to contain and remediate incidents. The analyst uses enterprise security technologies, including SIEM, EDR/XDR, threat intelligence platforms, and security monitoring tools, to identify malicious activity, investigate anomalies, and improve the organization’s security posture. The role specifically uses Microsoft Sentinel to analyze data flows and security logs, identify potential threats, conduct threat hunting, manage policy abuse, track incidents in Resilient, and recommend Sentinel optimizations and log-parsing improvements. The analyst defines Sentinel use cases, dashboards, and filters; communicates and shares findings with global and extended teams; provides support hours as required; and prepares documentation such as playbooks. The role requires understanding enterprise environments and working from high-level direction in collaboration with the CSIRT and other CDOC products.

Requirements

Bachelor’s degree in Computer Science, Data Science, Engineering, Information Science, Statistics, Information Systems, or another relevant discipline from an accredited university or recognized higher education institution; equivalent international or regionally accredited qualifications are accepted.
At least 3 years of overall experience working as a Security Analyst in enterprise environments.
At least 2 years of hands-on experience with Microsoft Sentinel SIEM, including configuration, tuning, and incident investigation.
Strong understanding of SIEM concepts, architecture, and operational workflows.
Proven experience supporting and maintaining SIEM platforms in complex, large-scale enterprise infrastructures.
Excellent analytical and problem-solving skills, including the ability to troubleshoot and resolve security-related issues effectively.
Strong communication skills and the ability to explain technical concepts to technical and non-technical stakeholders, management, and cross-functional teams.
Solid understanding of enterprise environments, including networking, web services, databases, and operating systems.

Nice To Haves

Experience with MITRE ATT&CK.

Responsibilities

Use SIEM tools daily to analyze data flows and identify potential threats and anomalies.
Analyze logs from security infrastructure, including firewalls and IPS.
Conduct internal threat hunting and manage policy abuse based on SIEM information.
Gather threat intelligence data.
Recognize potential successful and unsuccessful intrusion attempts and compromises.
Log incidents and track them using the Resilient incident management tool.
Suggest Microsoft Sentinel optimizations and source log-parsing improvements.
Define Sentinel use cases, dashboards, and filters as needed.
Communicate issues with global teams and share results and ideas with the extended team.
Provide hours of support as required.
Create documentation, such as playbooks, for other team members.
Work from high-level direction and collaborate with the CSIRT and other products within the CDOC team.