Cyber Security Operations Center Analyst / AI-Automation Engineer

Micron Technology•Boise, ID

About The Position

The Cyber Security Operations Center (CSOC) Analyst / AI-Automation Engineer is a hybrid cybersecurity role combining security operations, threat investigation, detection engineering, and AI-enabled automation development. The role investigates and responds to cyber threats while improving Cyber Defense operations through automation of repetitive analyst workflows, engineered responses, stronger detections, and AI-assisted capabilities. It supports the CSOC’s move toward hybrid roles and a 16x5 operating schedule. The role emphasizes improving defense capability through each investigation: identifying opportunities to automate or redesign workflows, addressing detection gaps, and turning effective investigation techniques into reusable playbooks, automation, or AI-enabled capabilities. AI agents are designed and operated to support investigation, enrichment, threat analysis, and response, with least-privilege access, safeguards for high-impact actions, evaluation against historical analyst outcomes, and auditable evidence.

Requirements

Background in cybersecurity operations, incident response, threat hunting, detection engineering, security engineering, or a related field.
Understanding of attacker behaviors and common techniques across endpoint, identity, network, cloud, and application environments.
Working knowledge of MITRE ATT&CK and modern incident investigation methodologies.
Experience analyzing logs and security telemetry using SIEM, EDR/XDR, or similar technologies.
Ability to develop or modify automation in at least one language or scripting technology, such as Python, PowerShell, JavaScript/TypeScript, or REST APIs.
Understanding of APIs, JSON, authentication, and system integrations.
Ability to independently solve technical problems and work through ambiguous security investigations.
Strong written communication and documentation skills.

Nice To Haves

Experience building SOAR and security automation workflows.
Experience building or maintaining security detections, including detection-as-code practices.
Background in cloud and identity security.
Familiarity with Git and version control, testing, APIs, and CI/CD.
Experience integrating security platforms with ticketing, case-management, or workflow systems.
Experience building AI agents or LLM-powered workflows for security or IT operations using a framework or platform such as Claude Agent SDK or Azure AI Foundry.
Experience building or integrating MCP servers or other tool-calling interfaces for LLMs.
Familiarity with RAG, AI evaluation methods, or LLM observability.
Relevant certifications such as GCIH, GCIA, GCFA, GCTI, OSCP, Security+, CISSP, or cloud security certifications.

Responsibilities

Investigate, triage, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments.
Hunt for malicious or anomalous activity and correlate telemetry across security platforms to determine scope, impact, and appropriate responses.
Implement and continuously improve incident response and investigation playbooks.
Partner with threat intelligence, detection engineering, incident response, vulnerability management, and other security teams on complex investigations.
Develop and tune detections based on emerging threats, attack techniques, intelligence, and investigation lessons.
Identify detection gaps and recommend improvements to telemetry, correlation, and response logic.
Translate analyst knowledge and investigation techniques into repeatable detection and response capabilities, using frameworks such as MITRE ATT&CK.
Assess repetitive analyst work and determine whether to automate, eliminate, redesign, or retain it based on volume, risk, and process stability.
Build scripts, playbooks, and integrations using Python, PowerShell, REST APIs, SOAR, and workflow platforms to connect security tools, telemetry sources, and case-management systems.
Engineer automations with production-quality error handling, retries, idempotent actions, structured logging, and failure alerts.
Add appropriate safeguards to automated responses, including human approval for disruptive actions, exclusion lists, action limits, and tested rollback.
Manage automation as code through source control, peer review, non-production testing, and change-managed promotion.
Use least-privilege service identities and managed secrets, and maintain credentials and API permissions throughout their lifecycle.
Document, monitor, and maintain automation as upstream tools change; measure outcomes such as analyst hours returned, response times, consistency, and error rates.
Pay particular attention to the risk that automation may close cases that require escalation.
Design, build, and operate AI agents for investigation, enrichment, threat analysis, and response by querying SIEM, EDR, identity, threat intelligence, and case-management systems.
Build agent tools with MCP and platform APIs, using narrowly scoped least-privilege access and separating read-only from state-changing actions.
Match AI autonomy to each use case, use policy-based controls for high-impact decisions, and ground reusable agent instructions and skills in trusted sources.
Defend AI workflows against prompt injection, evaluate agents against historical analyst ground truth, and run them in shadow mode before granting autonomy.
Log prompts, tool calls, and evidence for auditability, and require cited evidence and validation before AI analysis informs decisions.
Identify opportunities for AI to augment analyst judgment, not only automate existing processes.
Document investigation logic so it can be converted into detections, automation, playbooks, or AI workflows.
Participate in retrospectives, recommend improvements after incidents and significant investigations, and continuously develop skills across cybersecurity, software engineering, automation, and AI.