Security Operations Analyst

onsemi•Scottsdale, AZ

About The Position

The Security Operations Analyst supports the detection, investigation, response, and ongoing improvement of cybersecurity capabilities across enterprise environments. The role monitors security events, conducts initial investigations, supports incident response, contributes to detection and security engineering, and helps improve operational efficiency through automation and AI-assisted processes. The ideal candidate is analytical, technically curious, process-oriented, and interested in developing practical cybersecurity and AI-enabled operations expertise. They use approved AI tools to assist their work, validate generated outputs, document assumptions, and escalate decisions or risks requiring senior review. The role also calls for sound judgment, attention to detail, a learning mindset, ownership of assigned work, clear communication, and responsible experimentation with automation and AI under guidance from senior analysts and engineering teams.

Requirements

1–3 years of experience in Security Operations, Incident Response, IT Operations, Security Engineering, or a related cybersecurity environment.
Experience monitoring, triaging, investigating, and escalating security events using established operational processes.
Experience supporting incident response and documenting investigations through closure.
Ability to work independently on assigned tasks, collaborate effectively within a team, and escalate when appropriate.
Foundational understanding of security operations, threat detection, incident response, security engineering, and responsible use of automation or AI.
Working knowledge of networking, authentication, operating systems, cloud technologies, and enterprise security controls.
Familiarity with Windows, Linux/Unix, macOS, and cloud computing platforms.
Experience with technologies such as SIEM, EDR, IDS/IPS, DLP, SOAR, email security, IAM, vulnerability management, and log analysis platforms.
Understanding of indicators of compromise, attack methodologies, detection logic, and basic malware concepts.
Strong analytical, problem-solving, communication, collaboration, prioritization, and documentation skills.
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, or equivalent practical experience.

Responsibilities

Monitor security platforms, dashboards, alerts, and operational reporting channels for potential cybersecurity threats and operational incidents.
Review, triage, investigate, and validate alerts from SIEM, EDR, DLP, IAM, network, email, cloud, and other monitoring technologies.
Use approved AI-assisted capabilities to summarize alerts, enrich cases, correlate evidence, develop investigative leads, and improve response speed, validating outputs against source data.
Execute established incident response playbooks, operational procedures, escalation paths, and human-review requirements.
Support evidence collection, documentation, containment activities, case tracking, remediation coordination, and incident closure.
Escalate incidents, uncertain AI outputs, access concerns, and decisions requiring advanced analysis to senior analysts and response teams.
Maintain awareness of active incidents, emerging threats, and operational risks during assigned shifts.
Correlate endpoint, network, identity, cloud, application, and security telemetry to identify indicators of compromise and suspicious activity.
Assist in identifying attacker tactics, techniques, and procedures through investigative analysis, threat intelligence, and behavioral context.
Use OSINT, threat intelligence feeds, approved AI tools, and operational reporting to support investigations and improve threat visibility.
Support hypothesis-driven threat hunting to identify emerging risks and previously undetected malicious behavior.
Assist in developing, tuning, testing, and maintaining detection content, alert logic, analytics rules, dashboards, and use cases.
Use AI as a supervised aid for query development, alert clustering, detection documentation, false-positive review, and coverage-gap analysis.
Identify recurring attack patterns, false positives, telemetry gaps, and opportunities to improve detection effectiveness.
Develop working knowledge of MITRE ATT&CK, threat modeling, NIST incident response concepts, and modern detection methodologies.
Support deployment, configuration, maintenance, and optimization of security operations technologies and integrations.
Support SOAR, workflow automation, orchestration, and AI-assisted security operations initiatives.
Use scripting, query languages, APIs, and automation tools to improve investigation workflows, reporting, enrichment, and repeatable operational tasks.
Assist senior analysts and engineers with configuring, testing, and tuning AI agents for defined SecOps use cases, including triage, enrichment, knowledge retrieval, reporting, threat hunting, and detection support.
Help refine agent instructions, retrieval content, context, tool access, guardrails, escalation logic, and test-case evaluation within approved boundaries.
Record agent errors, unsupported claims, inconsistent results, access issues, and workflow failures, and provide structured feedback for improvement.
Validate AI-agent outputs against authoritative telemetry and case evidence before use in investigations or operational decisions.
Collaborate with engineering and security teams to improve visibility, strengthen controls, and evaluate emerging AI-driven security capabilities.
Contribute to AI SOC initiatives by identifying repeatable analyst pain points, candidate use cases, automation opportunities, and measurable success criteria.
Participate in proofs of concept, controlled pilots, user acceptance testing, agent evaluations, and post-deployment feedback activities.
Help document AI-enabled workflows, expected outputs, known limitations, human-review steps, escalation paths, and fallback procedures.
Provide feedback on AI SOC usability, trust, accuracy, efficiency, and operational risk.
Demonstrate responsible experimentation, professional accountability, and willingness to learn from testing and operational outcomes.
Produce incident summaries, investigation reports, shift handoffs, operational updates, and concise AI evaluation findings.
Communicate technical findings, confidence, limitations, and recommended next steps to technical and non-technical stakeholders.
Support metrics for detection quality, investigation speed, automation reliability, agent accuracy, analyst adoption, and program effectiveness.
Partner with security, infrastructure, engineering, risk, privacy, legal, and business teams as appropriate to support cybersecurity and AI SOC initiatives.