Cyber Threat Detection and Response Analyst

McKesson•Richmond, VA

2d•$98,900 - $164,900

About The Position

The Senior Cybersecurity Threat Detection & Response (TDR) Analyst implements and supports detection engineering and response enablement solutions. Working under the direction of senior engineers and in partnership with the SOC/CSIRT, the analyst helps onboard and normalize logs, build and tune detection rules, support alert triage and incident response, and maintain the health and performance of detection platforms such as SIEM, EDR/XDR, and SOAR. The role assists with planning and execution, performs assigned engineering tasks within defined scope and guidance, and follows established security policies, standards, and procedures. It uses internal and external research tools to understand threats and detections, documents work such as use cases, runbooks, and change records, and escalates risks or issues to support timely response and remediation. McKesson Medical-Surgical (MMS), which is expected to become Wellverse in early 2027, is a subsidiary and publicly reported segment of McKesson Corporation. MMS distributes medical-surgical supplies, pharmaceuticals, diagnostic equipment and supplies, and other solutions and services to healthcare settings and providers outside traditional hospitals.

Requirements

Degree or equivalent and typically 4+ years of relevant experience; the skills and qualifications section also states 6+ years of cybersecurity and/or IT operations experience with exposure to security monitoring, detection engineering, incident response, or SOC-supporting engineering.
Experience supporting or implementing monitoring and detection tools such as SIEM, EDR, IDS/IPS, logging agents/collectors, or vulnerability scanners; ability to validate data collection and basic alert behavior.
Ability to follow change-management processes, document work, and meet SLA expectations for assigned tasks, tickets, and detection tuning requests.
Willingness to learn threat concepts, detection engineering practices, and internal tooling; participate in training, tabletop exercises, and continuous improvement activities.
Working knowledge of SIEM, EDR/XDR, IDS/IPS, firewalls, and threat intelligence feeds; familiarity with ticketing and case-management workflows.
Experience onboarding or supporting log sources and telemetry pipelines, including Windows/Linux, network-device, and cloud logs, and basic parsing and normalization concepts.
Ability to follow runbooks and procedures, troubleshoot collection and detection issues, and clearly document changes in use cases, tickets, runbooks, and change records.
Foundational understanding of incident response and security telemetry triage; ability to gather evidence and coordinate with SOC/IR teams.
Strong collaboration and communication skills, including appropriate escalation and effective work with SOC analysts, incident responders, and infrastructure/application owners.
Integrity, curiosity, adaptability, and commitment to continually improving technical skills.
Familiarity with one or more cloud platforms (AWS, Azure, or GCP) and cloud logging/monitoring concepts such as IAM signals, audit logs, flow logs, and service logs.
Basic scripting or automation skills such as Python, PowerShell, or Bash, and willingness to learn detection query languages such as SPL/KQL or equivalent.
Working knowledge of Windows and Linux logging and troubleshooting fundamentals, including processes, authentication events, and network connections.
Familiarity with security frameworks and standards such as NIST and CIS Benchmarks, and adherence to security policies and standard operating procedures.
Strong organizational skills and ability to manage multiple tasks, meet SLA expectations, and document work for operational continuity.
Ability to participate in on-call or after-hours incident support as needed and collaborate calmly during high-severity events.
Bachelor’s degree in computer science, information security/assurance, MIS, engineering, or a related field, or equivalent practical experience.

Nice To Haves

Familiarity with basic adversary concepts such as MITRE ATT&CK and kill chain fundamentals.
Security+, SSCP, or equivalent foundational security certification.
TDR/SecOps certifications, such as Google Cloud Professional Cloud Security Engineer, Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, or GIAC certifications such as GSEC or GCIH.

Responsibilities

Implement and maintain security log and telemetry collection for endpoints, network devices, cloud services, identity systems, and applications according to documented standards and change-management procedures.
Support SIEM and related detection platforms by onboarding data sources, validating parsing and normalization, maintaining data integrity, and monitoring platform health and capacity.
Create, implement, and tune SIEM/EDR/XDR detection rules and alerts to improve fidelity and reduce noise; document logic, assumptions, and expected outcomes.
Support alert triage and incident response by collecting logs and evidence, assisting with containment and eradication tasks, and coordinating engineering fixes as directed.
Assist with SOAR automation and orchestration use cases; test and validate playbook changes with SOC/IR.
Develop and execute detection and response workflow test plans, including use-case testing and regression checks; identify gaps and recommend improvements.
Work with security operations, infrastructure, and application teams to resolve telemetry issues, implement secure logging configurations, and support remediation of security findings.
Stay current on threats and attacker techniques and use research tools and frameworks, including MITRE ATT&CK fundamentals, to help map detections to common tactics and techniques.
Perform other duties as assigned.