Information Security Risk Analyst

Lam Research•Tualatin, OR

3d•Hybrid

About The Position

The Cyber Threat Analytics Analyst is responsible for identifying, developing, and improving the organization’s ability to detect malicious behavior, suspicious activity, and security anomalies across the enterprise. This role is part Information Security team focused on bringing detection development, threat analysis operationalization, SIEM correlation, behavioral analytics, and AI-assisted threat detection capabilities into the organization.The analyst will work closely with Security Operations, Incident Response, and Vulnerability Management teams to improve detection coverage, reduce false positives, and identify threats that may bypass traditional controls.

Requirements

Analytical and curious cybersecurity professional who enjoys finding patterns in large volumes of security data.
Understands how attackers operate, how enterprise systems generate security telemetry, and how to turn threat intelligence into meaningful detections.
Comfortable working across SIEM data, endpoint telemetry, identity logs, cloud activity, email security events, network data, and behavioral analytics platforms.
Able to think like an attacker, understand normal business behavior, and identify signals that indicate suspicious or malicious activity.
Security Operations Center analysis
Threat hunting
SIEM rule development
Threat intelligence analysis
Incident response
Detection tuning
Behavioral analytics or UEBA
Cloud, endpoint, identity, or network security monitoring

Nice To Haves

Experience with SIEM platforms such as Microsoft Sentinel, Splunk, Exabeam, Securonix, or similar tools.
Experience writing detection queries using KQL, SPL, SQL, or similar query languages.
Familiarity with Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Microsoft Sentinel, Entra ID, or similar security platforms.
Understanding of MITRE ATT&CK and common adversary tactics, techniques, and procedures.
Experience using threat intelligence to create detections and threat hunting hypotheses.
Experience with AI-assisted analytics, UEBA, anomaly detection, or behavioral baselining.
Familiarity with cloud security monitoring across Azure, AWS, or Google Cloud.
Ability to analyze logs from identity systems, endpoints, firewalls, proxies, email gateways, SaaS applications, and cloud platforms.
Experience documenting detection logic, investigation steps, and response guidance.
Scripting or automation experience with Python, PowerShell, Logic Apps, or similar tools.
Familiarity with MISP, STIX/TAXII, threat intelligence feeds, or indicator management.
Certifications such as GCIH, GCIA, GCDA, GMON, GCTI, GCFA, Security+, CySA+, CISSP, or equivalent experience.

Responsibilities

Develop, test, tune, and maintain SIEM detection rules, log correlation searches, alerts, dashboards, and analytics.
Translate threat intelligence, adversary tactics, and emerging attack trends into actionable detections.
Build and improve analytics to identify malicious behavior, compromised accounts, lateral movement, and anomalous activity.
Use AI-driven analytics, UEBA, and behavioral baselining to identify activity that deviates from normal user, endpoint, network, cloud, and application behavior.
Map detection content to MITRE ATT&CK tactics and techniques to identify coverage strengths and gaps.
Partner with SOC analysts to improve alert triage, investigation playbooks, enrichment, and escalation criteria.
Support Incident Response during active investigations by analyzing logs, identifying patterns, and developing new detections from lessons learned.
Identify gaps in logging, telemetry, and visibility and recommend improvements to security monitoring coverage.
Document detection logic, assumptions, data sources, expected behavior, response guidance, and tuning decisions.
Track detection effectiveness, alert fidelity, false positive rates, detection coverage, and time-to-detect improvements.