Position Summary
The Security Operations Analyst supports the detection, investigation, response, and continuous improvement of cybersecurity capabilities across enterprise environments. The role monitors security events, conducts initial investigations, supports incident response, contributes to detection and security engineering, and helps develop operational efficiencies through automation and AI-assisted processes.
The ideal candidate is analytical, technically curious, process-oriented, and eager to develop practical cybersecurity and AI-enabled operations expertise. This individual uses approved AI tools as an analyst accelerator, validates generated outputs, documents assumptions, and escalates decisions or risks that require senior review.
Ideal Candidate Profile
The ideal candidate demonstrates sound judgment, attention to detail, a learning mindset, and ownership of assigned work. They can follow established procedures, communicate findings clearly, experiment responsibly with automation and AI, and contribute to tuning AI agents and advancing AI SOC initiatives under the guidance of senior analysts and engineering teams.
Security Monitoring, Detection & Incident Response
- Monitor security platforms, dashboards, alerts, and operational reporting channels for potential cybersecurity threats and operational incidents.
- Review, triage, investigate, and validate alerts generated by SIEM, EDR, DLP, IAM, network, email, cloud, and other monitoring technologies.
- Use approved AI-assisted capabilities to summarize alerts, enrich cases, correlate evidence, develop investigative leads, and improve response speed while validating outputs against source data.
- Execute established incident response playbooks, operational procedures, escalation paths, and human-review requirements.
- Support evidence collection, documentation, containment activities, case tracking, remediation coordination, and incident closure.
- Escalate incidents, uncertain AI outputs, access concerns, or decisions requiring advanced analysis to senior analysts and response teams.
- Maintain situational awareness of active incidents, emerging threats, and operational risks during assigned shifts.
Threat Analysis, Hunting & AI-Augmented Detection Engineering
- Correlate endpoint, network, identity, cloud, application, and security telemetry to identify indicators of compromise and suspicious activity.
- Assist in identifying attacker tactics, techniques, and procedures through investigative analysis, threat intelligence, and behavioral context.
- Use OSINT, threat intelligence feeds, approved AI tools, and operational reporting to support investigations and improve threat visibility.
- Support hypothesis-driven threat hunting to identify emerging risks and previously undetected malicious behavior.
- Assist in developing, tuning, testing, and maintaining detection content, alert logic, analytics rules, dashboards, and use cases.
- Use AI as a supervised aid for query development, alert clustering, detection documentation, false-positive review, and coverage-gap analysis.
- Identify recurring attack patterns, false positives, telemetry gaps, and opportunities to improve detection effectiveness.
- Develop working knowledge of MITRE ATT&CK, threat modeling, NIST incident response concepts, and modern detection methodologies.
Security Engineering, Automation & AI Agent Operations
- Support deployment, configuration, maintenance, and optimization of security operations technologies and integrations.
- Support SOAR, workflow automation, orchestration, and AI-assisted security operations initiatives.
- Use scripting, query languages, APIs, and automation tools to improve investigation workflows, reporting, enrichment, and repeatable operational tasks.
- Assist senior analysts and engineers with configuring, testing, and tuning AI agents for defined SecOps use cases such as triage, enrichment, knowledge retrieval, reporting, threat hunting, and detection support.
- Help refine agent instructions, retrieval content, context, tool access, guardrails, escalation logic, and evaluation of test cases within approved boundaries.
- Record agent errors, unsupported claims, inconsistent results, access issues, and workflow failures; provide structured feedback for tuning and improvement.
- Validate AI-agent outputs against authoritative telemetry and case evidence before they are used in investigations or operational decisions.
- Collaborate with engineering and security teams to improve visibility, strengthen controls, and evaluate emerging AI-driven security capabilities.
AI SOC Innovation & Continuous Improvement
- Contribute to AI SOC initiatives by helping identify repeatable analyst pain points, candidate use cases, automation opportunities, and measurable success criteria.
- Participate in proofs of concept, controlled pilots, user acceptance testing, agent evaluations, and post-deployment feedback activities.
- Help document AI-enabled workflows, expected outputs, known limitations, human-review steps, escalation paths, and fallback procedures.
- Provide analyst feedback on usability, trust, accuracy, efficiency, and operational risk to improve AI SOC capabilities.
- Demonstrate responsible experimentation, professional accountability, and willingness to learn from testing and operational outcomes.
Documentation, Communication & Collaboration
- Produce incident summaries, investigation reports, shift handoffs, operational updates, and concise AI evaluation findings.
- Communicate technical findings, confidence, limitations, and recommended next steps to technical and non-technical stakeholders.
- Support metrics for detection quality, investigation speed, automation reliability, agent accuracy, analyst adoption, and program effectiveness.
- Partner with security, infrastructure, engineering, risk, privacy, legal, and business teams as appropriate to support cybersecurity and AI SOC initiatives.
- 1-3 years of experience in Security Operations, Incident Response, IT Operations, Security Engineering, or a related cybersecurity environment.
- Experience monitoring, triaging, investigating, and escalating security events using established operational processes.
- Experience supporting incident response and documenting investigations through closure.
- Ability to work independently on assigned tasks while collaborating effectively within a team and escalating when appropriate.
- Foundational understanding of security operations, threat detection, incident response, security engineering, and responsible use of automation or AI.
- Working knowledge of networking, authentication, operating systems, cloud technologies, and enterprise security controls.
- Familiarity with Windows, Linux/Unix, macOS, and cloud computing platforms.
- Experience with technologies such as SIEM, EDR, IDS/IPS, DLP, SOAR, email security, IAM, vulnerability management, and log analysis platforms.
- Understanding of indicators of compromise, attack methodologies, detection logic, and basic malware concepts.
- Strong analytical, problem-solving, communication, collaboration, prioritization, and documentation skills.
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, or equivalent practical experience.
We are committed to sourcing, attracting, and hiring high-performance innovators, while providing all candidates a positive recruitment experience that builds our brand as a great place to work.
onsemi is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, ethnicity, color, religion, ancestry, national origin, age, marital status, pregnancy, sex, sexual orientation, physical or mental disability, medical condition, genetic information, military or veteran status, gender identity, gender expression, or any other protected category under applicable federal, state, or local laws.
If you are an individual with a disability and require a reasonable accommodation to complete any part of the application process, or are limited in the ability or unable to access or use this online application process and need an alternative method for applying, you may contact Talent.acquisition@onsemi.com for assistance.
onsemi (Nasdaq: ON) is driving disruptive innovations to help build a better future. With a focus on automotive and industrial end-markets, the company is accelerating change in megatrends such as vehicle electrification and safety, sustainable energy grids, industrial automation, and 5G and cloud infrastructure. With a highly differentiated and innovative product portfolio, onsemi creates intelligent power and sensing technologies that solve the world’s most complex challenges and leads the way in creating a safer, cleaner, and smarter world.
More details about our company benefits can be found here:
https://www.onsemi.com/careers/career-benefits