Cyber Security Operations Center Analyst / AI-Automation Engineer
Micron Technology3 days ago
Responsibilities
- Investigate, triage, hunt, and respond to security alerts and incidents across endpoint, identity, network, cloud, email, and data-security environments.
- Correlate security telemetry, determine scope and impact, and partner with threat intelligence, detection engineering, incident response, and vulnerability management teams.
- Develop and tune detections, identify coverage gaps, and improve telemetry, correlation, response logic, and MITRE ATT&CK-aligned threat-hunting coverage.
- Build production-quality scripts, playbooks, integrations, and automated responses using Python, PowerShell, REST APIs, SOAR, and workflow platforms.
- Manage automation as code with source control, peer review, testing, change-managed promotion, monitoring, error handling, retries, safeguards, and rollback procedures.
- Design and operate AI agents that query SIEM, EDR, identity, threat-intelligence, and case-management systems for investigation and response support.
- Evaluate AI agents against historical analyst ground truth, protect against prompt injection, log prompts and tool calls, and require evidence and validation for AI-influenced decisions.
- Document investigation logic and convert analyst expertise into reusable detections, automation, playbooks, and AI workflows.
- Measure automation outcomes and participate in retrospectives and continuous defense improvements.
Requirements
- Experience in cybersecurity operations, incident response, threat hunting, detection engineering, security engineering, or a related field.
- Understanding of attacker behavior and common techniques across endpoint, identity, network, cloud, and application environments.
- Working knowledge of MITRE ATT&CK and modern incident investigation methodologies.
- Experience analyzing logs and security telemetry using SIEM, EDR/XDR, or similar technologies.
- Ability to develop or modify automation using at least one of Python, PowerShell, JavaScript/TypeScript, or REST APIs.
- Understanding of APIs, JSON, authentication, and system integrations.
- Ability to independently solve technical problems and work through ambiguous security investigations.
- Strong written communication and documentation skills.
- Preferred experience with SOAR workflows, security detections, detection-as-code, cloud security, and identity security.
- Preferred familiarity with Git, version control, testing, APIs, CI/CD, and integrations with ticketing, case-management, or workflow systems.
- Preferred experience building AI agents or LLM-powered security or IT operations workflows with Claude Agent SDK or Azure AI Foundry.
- Preferred experience integrating MCP servers or other LLM tool-calling interfaces, plus familiarity with RAG, AI evaluation, or LLM observability.
- Relevant certifications such as GCIH, GCIA, GCFA, GCTI, OSCP, Security+, CISSP, or cloud security certifications are a plus.
Benefits
- Medical, dental, and vision plans are available in all locations.
- Income-protection programs are provided for illness or injury, along with paid family leave.
- Robust paid time off and paid holidays are offered.
- The role supports a 16x5 operating schedule.
- Micron provides equal-opportunity employment and reasonable application-process accommodations.
Tech Stack
Categories
About Micron Technology
Micron Technology designs and manufactures memory and storage semiconductors—DRAM, NAND, NOR and SSDs—sold to device makers, cloud providers, and embedded/automotive markets. Founded in 1978 and headquartered in Boise, Idaho, it operates globally and sells under the Micron and Crucial brands as a public company (NASDAQ: MU). Its products support data center, AI, mobile, and PC systems, including high-bandwidth and multichip packages for performance- and space-constrained applications.