Cyber Analyst (CA)

Job Summary

As a Cyber Analyst (CA), you sit at the human-in-the-loop (HITL) checkpoint of our SitRep generation pipeline. You will review AI-generated SitReps - both those flagged by our automated confidence gate and those in routine QA sampling - determine whether the underlying detection is a true or false positive, diagnose why the pipeline got it right or wrong, and drive permanent fixes into the systems knowledge base and agent prompts.

You are the mechanism by which a mistake happens once instead of a thousand times

Job Title: Cyber Analyst - AI-Assisted MXDR Operations

Location: Pune/Ahmedabad

Key Responsibilities

• SitRep Triage & Investigation - Review AI-generated SitReps in our case management queue (TheHive), including escalations from low-confidence scoring, judge-model failures, and recurring-case matches
• Classify SitReps as False Positive, True Positive / Benign, or True Positive / Approved, using client context, detection logic, raw telemetry, and asset data
• Investigate underlying security events across network, endpoint, cloud, and identity telemetry to validate or refute the AI's findings
• Approve high-quality SitReps for client delivery; correct, annotate, or escalate the rest

Root-Cause Analysis of AI Output

For every false positive or benign finding, determine the failure category and drive the fix:

• Client condition issues - the detection is technically correct but expected/authorized in this clients environment contribute changes to Client Notes documentation and the client-context agent prompt
• Detection logic issues - the rule itself is flawed or over-broad contribute changes to Detection documentation and the detection agent prompt
• Payload / OCSF issues - event normalization, schema mapping, or pipeline parsing errors contribute changes to OCSF/payload/pipeline documentation
• Asset alignment issues - asset inventory, vulnerability, or hardening context is wrong or stale contribute changes to asset/vulnerability documentation

Knowledge Base & Prompt Engineering Contributions

• Author and edit the versioned Markdown knowledge corpus (detections, OCSF mappings, asset context, client notes) that grounds every SitRep the platform generates
• Propose, test, and sign off on changes to agent prompts before they go to production - your edits are permanent improvements, subject to testing and signoff, not one-off overrides
• Provide structured feedback (analyst edits, verdict rationale) that feeds our evaluation datasets and judge-model calibration

Reporting & Continuous Improvement

• Contribute to weekly triage-outcome reports used by CA Managers to identify systemic detection and content issues
• Support monthly client-outcome reporting alongside Customer Success
• Identify recurring failure patterns and propose upstream fixes rather than repeatedly triaging the same class of error

Required Qualifications

• 2-5 years in a SOC, MDR/MXDR, incident response, or detection engineering role (Tier 2 equivalent or above)
• Strong working knowledge of the MITRE ATT&CK framework and the ability to map detections and adversary behavior to techniques
• Hands-on experience investigating alerts across at least two of: SIEM, EDR, NDR, cloud security telemetry, identity/authentication logs
• Demonstrated ability to distinguish true positives from false positives and articulate the reasoning in writing - clear, precise written communication is core to this job
• Familiarity with log formats and event normalization; ability to read raw payloads (JSON, syslog, cloud audit logs) and spot parsing or field-mapping errors
• Understanding of common detection logic (correlation rules, thresholds, behavioral analytics) and where each tends to generate noise
• Comfort working in ticketing/case management systems (TheHive, Jira, Linear or similar)

Preferred Qualifications

• Experience with OCSF (Open Cybersecurity Schema Framework) or other normalization schemas (ECS, CIM)
• Exposure to LLM-based tooling in security workflows - prompt writing, output evaluation, RAG systems, or AI-assisted triage - or strong curiosity and aptitude to learn it fast
• Detection engineering experience: writing or tuning rules in Sigma, KQL, Jupyter notebooks, or vendor-native languages
• Experience writing runbooks, knowledge-base articles, or detection documentation (Markdown fluency a plus)
• Familiarity with GCP or other cloud environments from an investigation standpoint
• Scripting ability (Python) for log analysis and triage automation
• Certifications such as GCIA, GCIH, GCFA, BTL1/BTL2, or CySA+ (valued, not required)

What Makes a Great Fit

• Skeptical by default, curious by nature. You dont rubber-stamp AI output, and you dont dismiss it either - you verify, then diagnose
• Root-cause oriented. Closing a ticket isnt the goal

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.