Description
The Cyber Fusion Center protects the business by combining threat intelligence, monitoring, detection engineering, incident response, and security automation into one proactive, intelligence-led defense capability.
Responsibilities and Impact
- Design, develop, test, and maintain high-quality detections for various threats
- Develop detection logic across multiple security platforms using tools like Splunk SPL, Microsoft Sentinel KQL, and Elastic Query DSL
- Apply artificial intelligence, machine learning, and data science techniques to identify anomalous behavior and emerging threats
- Build and maintain security analytics and data pipelines using Python, SQL, and Databricks
- Perform feature engineering, statistical analysis, model development, testing, tuning, and performance monitoring for security use cases
- Conduct threat hunting and hypothesis-driven investigations to identify gaps in existing detection coverage
- Map detections to the MITRE ATT&CK framework and improve coverage of priority attack techniques
- Analyze false positives, false negatives, alert quality, and detection performance, implementing improvements based on measurable results
- Collaborate with various teams to develop effective detection capabilities
- Implement detection-as-code practices using version control, peer review, automated testing, CI/CD, documentation, and controlled deployment
- Support purple-team exercises, adversary simulations, attack replay, and detection validation activities
- Explore the use of Generative AI, Large Language Models, and Agentic AI to improve threat research, detection development, alert analysis, and investigations
- Develop Power BI dashboards and reports to communicate detection coverage, alert trends, model performance, data quality, and operational metrics
- Document detection logic, data sources, analytical methods, model limitations, investigation procedures, and response recommendations
What We're Looking For
- Five or more years of experience in cybersecurity, threat detection, detection engineering, threat hunting, security analytics, or a related field
- Strong knowledge of security operations, incident response, threat intelligence, attack techniques, and enterprise security technologies
- Hands-on experience developing detections for SIEM, EDR/XDR, cloud, network, identity, or application security platforms
- Strong Python and SQL skills, including experience processing and analyzing large security datasets
- Practical experience with data science and machine learning methods
- Experience with Python libraries like Pandas, NumPy, scikit-learn, and Matplotlib
- Experience using Databricks, data lakes, Spark, or other large-scale data processing platforms
- Experience with one or more detection technologies, such as Splunk SPL, Microsoft Sentinel KQL, Elastic, Sigma, YARA, Suricata, Snort, or EDR query languages
- Understanding of MITRE ATT&CK and the detection engineering lifecycle
- Strong analytical, problem-solving, documentation, and communication skills
What’s In It For You?
- Health & Wellness: Health care coverage designed for the mind and body
- Flexible Downtime: Generous time off helps keep you energized for your time on
- Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills
- Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs
- Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best-in-class benefits for families
- Beyond the Basics: From retail discounts to referral incentive awards,small perks can make a big difference