Security Analytics Engineer

Role Overview

The Security Analytics Engineer designs, operates, and continuously improves the organization's security telemetry, analytics, detection engineering, and observability capabilities. The role provides the data and analytics foundation used by Security Operations while extending traditional SIEM capabilities through behavioral analytics, automation, AI-assisted correlation, and observability for autonomous and agentic systems.

Key Responsibilities

• Design and operate scalable security analytics platforms and telemetry pipelines.
• Integrate, normalize, enrich, and correlate telemetry from endpoint, identity, cloud, application, infrastructure, network, and AI-enabled systems.
• Develop and tune behavioral detections, correlation logic, dashboards, and alerting strategies.
• Translate threat intelligence, incidents, vulnerability findings, and offensive-security results into improved detection content.
• Build observability for AI agents and autonomous workflows, including identity, tool usage, execution activity, and security-relevant behavior.
• Apply AI-assisted techniques to log analysis, correlation, anomaly detection, enrichment, and investigation support.
• Automate telemetry management and security workflows while maintaining appropriate human oversight and explainability.
• Optimize SIEM and related systems platform reliability, data quality, performance, retention, and cost.

Qualifications

• Experience engineering SIEM, security analytics, detection, observability, or large-scale telemetry systems.
• Strong knowledge of logging, event correlation, normalization, enrichment, and security data pipelines.
• Experience developing detections, behavioral analytics, or correlation logic.
• Experience integrating security telemetry from diverse enterprise and cloud environments.
• Scripting or software-development experience and familiarity with APIs and Infrastructure-as-Code.
• Understanding of modern cloud and distributed architectures.
• Familiarity with security telemetry standards, MITRE ATT&CK, AI-assisted analytics, or observability of AI/agentic systems is preferred.