Threat Detection Analyst (Expert)

This position is an onsite role available at any Huntington Corporate office location: Detroit, MI; Dallas, TX; Columbus, OH; Pittsburgh, PA; Minnetonka, MN; or Atlanta, GA.

About the role

The Threat Detection Analyst Expert develops, tunes, validates, and maintains threat detection content across the organization's security platforms. This role leverages threat intelligence, adversary tradecraft, attack simulations, and data analytics to identify detection opportunities and improve visibility into malicious activity. The analyst works closely with Incident Response, Cybersecurity Operations, Threat Intelligence, Security Engineering, and IT Operations teams to improve detection coverage, reduce detection gaps, and enhance the organization's ability to identify adversary behavior. This role is responsible for the full detection lifecycle, including design, testing, deployment, tuning, validation, and continuous improvement of threat detections.

Responsibilities

• Provide leadership, mentorship, and training opportunities for junior Threat Detection Analysts.
• Design, develop, test, deploy, and maintain threat detections across SIEM, XDR, EDR, cloud, and network security platforms.
• Conduct detection engineering activities aligned to the MITRE ATT&CK framework and known adversary behaviors.
• Analyze threat intelligence, attack techniques, and emerging threats to identify new detection opportunities.
• Develop and maintain detection use cases, analytics, correlation rules, anomaly detections, and behavioral detections.
• Perform detection validation through threat simulations, purple team exercises, adversary emulation, and attack replay testing.
• Conduct detection gap assessments and identify areas requiring additional visibility or telemetry.
• Continuously tune and optimize detection logic to improve fidelity and reduce false positives and false negatives.
• Create and maintain detection documentation, testing procedures, and coverage mappings.
• Analyze security telemetry and log sources to identify opportunities for improved monitoring coverage.
• Develop content and requirements for new log sources, telemetry collection, and data quality improvements.
• Partner with Incident Response teams to improve detection content based on investigations and lessons learned.
• Collaborate with Threat Intelligence teams to operationalize indicators, emerging threats, and attacker TTPs.
• Maintain awareness of emerging attack techniques, cybersecurity trends, and advancements in detection methodologies.
• Measure and report on detection health, coverage effectiveness, and detection performance metrics.
• Perform other duties as assigned.

Requirements

• High School Diploma or 8+ additional years of equivalent experience.
• 5+ years of experience in Cybersecurity.
• 1+ years data analytics experience within the threat detection space.

Qualifications

• Bachelor's degree or 4+ additional years of equivalent experience.
• Professional experience with Palo Alto Cortex XSIAM, Microsoft Sentinel, Splunk, Microsoft Defender XDR, or similar detection platforms.
• Strong experience developing, testing, deploying, and maintaining threat detections across enterprise security technologies.
• Experience creating detection logic based on MITRE ATT&CK techniques, threat intelligence, and real-world adversary behaviors.
• Experience conducting detection validation using attack simulation, adversary emulation, or purple team methodologies.
• Experience tuning detections to reduce false positives while maintaining detection efficacy.
• Ability to conduct detection coverage analysis and detection gap assessments.
• Familiarity with detection-as-code methodologies and version-controlled detection development processes.
• Experience writing and optimizing KQL, SPL, XQL, SQL, or similar analytics languages.
• Strong understanding of attacker tactics, techniques, and procedures (TTPs).
• Experience working with large-scale security telemetry and log analytics.
• Knowledge of common attack vectors including phishing, credential theft, ransomware, cloud attacks, insider threats, and lateral movement.
• Familiarity with threat hunting concepts and the conversion of hunt hypotheses into operational detections.
• Understanding of Windows, Linux, macOS, Active Directory, Azure AD/Entra ID, and cloud security telemetry.
• Experience with scripting and automation using Python, PowerShell, Bash, or similar languages.
• Knowledge of common network protocols such as HTTP/S, DNS, SMTP, SSH, LDAP, and Kerberos.
• Understanding of cybersecurity frameworks including MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and detection engineering best practices.
• Strong analytical, communication, presentation, and problem-solving skills.
• Occasional travel may be required.

Workplace Type

This is an office-based role. Huntington combines in-office and work-from-home opportunities, enabling teams to deepen connections and maintain a strong community. Remote roles may occasionally require in-office attendance for key moments.

Pay

The compensation range for this position is $70,000 - $140,000 annual salary. Actual compensation will vary based on factors including location, experience, and education. Colleagues in this position are also eligible to participate in an applicable incentive compensation plan.

Benefits

• Health insurance coverage
• Wellness program
• Life and disability insurance
• Retirement savings plan
• Paid leave programs
• Paid holidays and paid time off (PTO)