Cyber Security Operations Center Analyst / AI-Automation Engineer

Micron•Boise, ID

About The Position

The Cyber Security Operations Center (CSOC) Analyst / AI-Automation Engineer is a hybrid cybersecurity role combining security operations, threat investigation, detection engineering, and AI-enabled automation development. The role investigates and responds to cyber threats while improving Cyber Defense operations by automating repetitive analyst workflows, engineering automated responses, strengthening detections, and building AI-assisted capabilities. The position supports the CSOC’s transition to hybrid roles and its 16x5 operating schedule. The successful candidate will turn investigation techniques into reusable playbooks, automation, and AI-enabled capabilities, improving the organization’s ability to defend against current and future threats. The role also designs, builds, and operates AI agents for security investigations and response. These capabilities must use appropriately scoped access, safeguards for high-impact actions, trusted sources, evaluation against historical analyst ground truth, and auditable records of prompts, tool calls, and evidence.

Requirements

Background in cybersecurity operations, incident response, threat hunting, detection engineering, security engineering, or a related field.
Understanding of attacker behaviors and common techniques across endpoint, identity, network, cloud, and application environments.
Working knowledge of MITRE ATT&CK and modern incident investigation methodologies.
Experience analyzing logs and security telemetry using SIEM, EDR/XDR, or similar technologies.
Ability to develop or modify automation in at least one language or scripting technology, such as Python, PowerShell, JavaScript/TypeScript, or REST APIs.
Understanding of APIs, JSON, authentication, and system integrations.
Ability to independently solve technical problems and work through ambiguous security investigations.
Strong written communication and documentation skills.

Nice To Haves

Experience building SOAR and security automation workflows.
Experience building or maintaining security detections, including detection-as-code practices.
Background in cloud and identity security.
Familiarity with Git and version control, testing, APIs, and CI/CD.
Experience integrating security platforms with ticketing, case-management, or workflow systems.
Experience building AI agents or LLM-powered workflows for security or IT operations using a framework or platform such as Claude Agent SDK or Azure AI Foundry.
Experience building or integrating MCP servers or other tool-calling interfaces for LLMs.
Familiarity with RAG, AI evaluation methods, or LLM observability.
Relevant certifications such as GCIH, GCIA, GCFA, GCTI, OSCP, Security+, CISSP, or cloud security certifications.

Responsibilities

Investigate, triage, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments.
Hunt for malicious or anomalous activity and correlate telemetry across security platforms to determine scope, impact, and appropriate response.
Implement and continuously improve incident response and investigation playbooks.
Partner with threat intelligence, detection engineering, incident response, vulnerability management, and other security teams on complex investigations.
Develop and tune detections based on emerging threats, attack techniques, intelligence, and investigation lessons.
Identify detection gaps and recommend improvements to telemetry, correlation, and response logic.
Convert analyst knowledge and investigation techniques into repeatable detection and response capabilities, using frameworks such as MITRE ATT&CK.
Assess repetitive analyst work and determine whether it should be automated, eliminated, redesigned, or kept manual based on volume, risk, and process stability.
Build scripts, playbooks, and integrations using Python, PowerShell, REST APIs, SOAR, and workflow platforms to connect security tools, telemetry sources, and case-management systems.
Engineer automations to production standards, including error handling, retries, idempotent actions, structured logging, and failure alerts.
Add safeguards to automated response, including human approval for disruptive actions, exclusion lists, action limits, and tested rollback.
Manage automation as code through source control, peer review, non-production testing, and change-managed promotion.
Use least-privilege service identities and managed secrets, and maintain credentials and API permissions throughout their lifecycle.
Document, monitor, and maintain automations as upstream tools change; measure outcomes such as analyst time saved, triage and response time, consistency, and error rates.
Pay particular attention to preventing automation from closing cases that require escalation.
Design, build, and operate AI agents for investigation, enrichment, threat analysis, and response by querying SIEM, EDR, identity, threat intelligence, and case-management systems.
Build agent tools with MCP and platform APIs, using narrowly scoped least-privilege access and separating read-only from state-changing actions.
Match AI autonomy to each use case, with policy-based controls governing high-impact decisions and AI supporting analyst judgment.
Ground reusable AI instructions and skills in trusted sources such as runbooks and prior cases, and defend against prompt injection from untrusted content.
Evaluate AI agents against historical analyst ground truth and run them in shadow mode before granting autonomy.
Log prompts, tool calls, and evidence to make AI-influenced actions auditable, and require cited evidence and validation before AI analysis drives decisions.
Identify opportunities for AI to augment analyst judgment, not only automate existing processes.
Document investigation logic so analyst knowledge can be converted into detections, automation, playbooks, or AI workflows.
Participate in retrospectives and recommend improvements following incidents and significant investigations.
Continuously develop skills across cybersecurity, software engineering, automation, and AI.