Cyber Threat Analyst (Detection & Automation Engineering

Be an Early Applicant Remote Hiring Remotely in United States Senior level Remote Hiring Remotely in United States Senior level Designs and maintains automated, AI-enabled detection and response capabilities across enterprise security platforms. Integrates SIEM, EDR, SOAR, and threat intelligence technologies; analyzes security telemetry; develops and validates detection content and automation workflows; documents procedures and runbooks; and collaborates with SOC, threat intelligence, and incident response teams. The role also evaluates emerging security capabilities and supports continuous improvement of detection operations for a federal agency. The summary above was generated by AI

phia is hiring a Cyber Threat Analyst (Detection & Automation Engineering) to support cyber threat analysis and detection engineering and operations at a large Federal agency. The role requires close collaboration with security operations, threat intelligence, and incident response stakeholders, along with strong configuration development, testing, and documentation practices. The ideal candidate will have deep experience with cybersecurity threats and analysis workflows, detection capabilities and methodologies, and automation platforms and tools.

This position offers REMOTE work flexibility. Qualified candidates will be U.S. Citizens and located in the United States, able to achieve Public Trust security vetting approval.

What You’ll Do:

• Design, implement, and maintain automated, Artificial/Super Intelligence (AI/SI) enabled security detection, integration capabilities across enterprise security monitoring technologies.
• Strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows.
• Build automation and integration workflows to improve detection and response.
• Security Platform Integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
• Requirements-to-Implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
• Testing & Validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
• Security Data Analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
• Documentation & Sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations. Provide status and activity reporting and plans to management.
• Cross-Functional Coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
• Emerging Capability Evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.

Who You Are / What You Bring:

• Significant depth and expertise in:
• SOAR Platforms and Capabilities (SentinelOne Singularity Hyperautomation, Splunk Enterprise Security, Splunk SOAR)
• Artificial Intelligence (AI) / Super Intelligence (SI) Security
• SOC operations and processes
• Threat intelligence lifecycle and analysis
• Incident response methodologies
• Network protocols and architecture
• Operating systems (Windows/Linux/Unix)
• Cloud platforms (AWS/Azure/GCP)
• Security architecture and design
• Programming/scripting (Python, PowerShell, Bash)
• API integration and development
• Detection engineering methodologies
• Security automation and orchestration concepts
• Familiarly with Frameworks, Standards & Compliance:
• NIST SP 800-53 Security Controls, CIS Controls, MITRE ATT&CK Framework
• CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars and Federal Cybersecurity Directives, Privacy Act, Audits financial statements, quarterly financial information, and annual reports for manufacturing, retail, and distribution clients. Plans audits, assesses risks, tests internal controls, researches accounting issues, and performs work under GAAS, GAAP, PCAOB, AICPA, and SOX standards. The role involves client communication, relationship building, issue resolution, and training junior staff and interns. It requires a bachelor’s degree, CPA eligibility, accounting experience, and travel to client sites up to 50%. Top Skills: Aicpa Auditing StandardsGaapGaasPcaobSarbanes-Oxley (Sox)

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

• Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
• Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
• Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
• Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
• Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
• Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute

• Familiarity and experience in:
• Malware analysis
• Digital forensics analysis and procedures
• Risk assessment methodologies
• Ability to work independently, work in a fast-paced environment, and attention to detail.
• Excellent communication, organizational, and interpersonal skills, * Bachelors degree + 3 to 13 years of experience in cybersecurity analysis and engineering (cyber threat analysis, intrusion analysis, detection engineering, etc.). Four additional years of experience can be substituted in lieu of a degree (7 - 17 years of experience).
• Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell, similar)

Required Certifications:

• CompTIA Security+ (or equivalent baseline cybersecurity certification)
• At least one of:
• GIAC Certified Intrusion Analyst (GCIA) or GX-IA
• GIAC Certified Incident Handler (GCIH) or GX-IH
• CompTIA CySA+ Cybersecurity Analyst

Desired Certifications (or similar):

• CompTIA SecAI+
• GIAC Continuous Monitoring (GMON)
• GIAC AI Security Automation Engineer (GASAE)
• GIAC Machine Learning Engineer (GMLE)
• Certified Information Systems Security Professional (CISSP)

Security Clearance/Vetting:

• U.S. Citizenship required
• Ability to obtain Public Trust clearance

phia offers excellent benefits to enhance work-life balance, including the following:

• Medical Insurance
• Dental Insurance
• Vision Insurance
• Life Insurance
• Short Term & Long Term Disability
• 401k Retirement Savings Plan with Company Match
• Paid Holidays
• Paid Time Off (PTO)
• Tuition and Professional Development Assistance, 2 Minutes Ago Remote or Hybrid 66K-89K Annually Mid level 66K-89K Annually Mid level Cloud * Fintech * Software * Business Intelligence * Consulting * Financial Services Develops and implements client technology solutions, troubleshoots complex IT environments, assesses Microsoft and cloud platforms, maintains technology roadmaps, leads security reviews, identifies modernization opportunities, and manages project scope, budgets, timelines, and client communications. The role serves as a senior escalation resource while providing consultative recommendations and coordinating internal technical teams., Remote or Hybrid United States 129K-174K Annually Senior level 129K-174K Annually Senior level Cloud * Fintech * Software * Business Intelligence * Consulting * Financial Services The Manager, Sales Architect leads the Sales Architect team, qualifying prospects, managing project handoffs, and designing solutions for technology sales.

phia LLC (“phia”) is a Northern Virginia based, small business established in 2011 with focus in Cyber Intelligence, Cyber Security/Defense, Intrusion Analysis & Incident Response, Cyber Architecture & Capability Analysis, Cyber Policy & Strategy, Information Assurance/Security, Compliance, Certification & Accreditation, Communications Security, Traditional Security, and Facilities Security. phia also provides cyber operations support functions such as: Program and Process Management, Engineering, Development, and Systems Administration that allows for Cyber Operations to efficiently integrate our customer’s missions and objectives. phia supports various agencies and offices within the Department of Defense (DoD), Federal government, and private/commercial entities.