Cyber Threat Detection and Response Analyst

McKesson•Richmond, VA

23h

About The Position

The Senior Cybersecurity Threat Detection & Response (TDR) Analyst implements and supports detection engineering and response enablement solutions. Working under the direction of senior engineers and in partnership with the SOC/CSIRT, the role helps onboard and normalize logs, build and tune detection rules, support alert triage and incident response, and maintain detection platform health and performance, including SIEM, EDR/XDR, and SOAR. The analyst performs assigned engineering tasks within defined scope and guidance, follows security policies and procedures, uses internal and external research tools to understand threats and detections, documents work, and escalates risks or issues to support timely response and remediation. McKesson Medical-Surgical (MMS), a McKesson Corporation subsidiary and publicly reported segment, distributes medical-surgical supplies, pharmaceuticals, diagnostic equipment and supplies, and other solutions and services to healthcare settings outside traditional hospitals. MMS serves alternate and non-acute care markets across the United States.

Requirements

Degree or equivalent and typically 4+ years of relevant experience.
6+ years of experience in cybersecurity and/or IT operations, with exposure to security monitoring, detection engineering, incident response, or SOC-supporting engineering.
Experience supporting or implementing monitoring and detection tools such as SIEM, EDR, IDS/IPS, logging agents/collectors, or vulnerability scanners; ability to validate data collection and basic alert behavior.
Ability to follow change-management processes, document work, and meet SLA expectations for assigned tasks, tickets, and detection-tuning requests.
Working knowledge of security monitoring technologies such as SIEM, EDR/XDR, IDS/IPS, firewalls, and threat intelligence feeds; familiarity with ticketing and case-management workflows.
Experience onboarding or supporting log sources and telemetry pipelines, including Windows/Linux, network device, and cloud logs, and basic parsing/normalization concepts.
Ability to follow runbooks and documented procedures, troubleshoot collection and detection issues, and clearly document changes.
Foundational understanding of incident response and security telemetry triage; ability to gather investigation evidence and coordinate with SOC/IR teams.
Strong collaboration and communication skills, including appropriate escalation and effective work with SOC analysts, incident responders, and infrastructure/application owners.
Familiarity with one or more cloud platforms (AWS, Azure, or GCP) and cloud logging/monitoring concepts such as IAM signals, audit logs, flow logs, and service logs.
Basic scripting or automation skills such as Python, PowerShell, or Bash, and willingness to learn detection query languages such as SPL/KQL or equivalents.
Working knowledge of Windows and Linux logging and troubleshooting fundamentals, including processes, authentication events, and network connections.
Familiarity with security frameworks and standards such as NIST and CIS Benchmarks, and with adhering to security policies and standard operating procedures.
Highly organized, able to manage multiple tasks, meet SLA expectations, and document work for operational continuity.
Ability to participate in on-call or after-hours incident support as needed and collaborate calmly during high-severity events.
Bachelor’s degree in computer science, information security/assurance, MIS, engineering, or a related field; or equivalent practical experience.

Nice To Haves

Security+, SSCP, or an equivalent foundational security certification (preferred, not required).
TDR/SecOps certifications, such as Google Cloud Professional Cloud Security Engineer, Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, or GIAC certifications such as GSEC or GCIH.
Familiarity with basic adversary concepts, such as MITRE ATT&CK or kill chain fundamentals.

Responsibilities

Implement and maintain security log and telemetry collection for endpoints, network devices, cloud services, identity systems, and applications, following documented standards and change-management procedures.
Support SIEM and related detection platforms by onboarding data sources, validating parsing and normalization, maintaining data integrity, and monitoring platform health and capacity.
Create, implement, and tune SIEM/EDR/XDR detection rules and alerts to improve fidelity and reduce noise; document logic, assumptions, and expected outcomes.
Support alert triage and incident response by collecting logs and evidence, assisting with containment and eradication tasks, and coordinating engineering fixes as directed.
Assist with SOAR and playbook automation use cases; test and validate playbook changes with SOC/IR.
Develop and execute detection and response workflow test plans, including use-case testing and regression checks; identify gaps and recommend enhancements.
Work with security operations, infrastructure, and application teams to resolve telemetry issues, implement secure logging configurations, and support security finding remediation.
Stay current on threats and attacker techniques and use research tools and frameworks, including MITRE ATT&CK fundamentals, to help map detections to common tactics and techniques.
Perform other duties as assigned.