Cyber Threat Management Senior Associate

Location: Allen Park, MI (Fairlane Business Park III)

Work Model: Shift-based 24x7 Operations Environment

Client is seeking a Cyber Threat Management Senior Associate to join its Product Security Operations Center (PSOC). This role is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats affecting connected vehicles, cloud services, APIs, and embedded automotive systems.

The ideal candidate will have experience in Security Operations Center (SOC) environments, incident response, cloud security operations, and API security. This position plays a key role in protecting Ford's connected vehicle ecosystem by analyzing security events, coordinating response activities, and improving detection capabilities across the enterprise.

• Monitor and triage security alerts generated through PSOC monitoring tools.
• Investigate cybersecurity incidents across cloud applications, APIs, vehicle telemetry, and embedded systems.
• Support the full incident response lifecycle, including identification, containment, eradication, recovery, and closure.
• Analyze logs, alerts, and telemetry data to identify potential threats and malicious activity.
• Collaborate with Cyber Incident Response Teams (CIRT), Product Security, Cloud Engineering, and Enterprise IT teams.
• Escalate and coordinate security incidents according to established procedures and response playbooks.
• Conduct root cause analysis and document investigation findings.
• Contribute to the development and enhancement of security monitoring and detection capabilities.
• Assist with alert tuning, threat detection optimization, and operational process improvements.
• Coordinate incident handoffs with global PSOC teams to ensure seamless 24x7 coverage.
• Maintain accurate incident documentation and communicate findings to technical stakeholders.

• Bachelor's Degree in Computer Science, Cybersecurity, Information Security, Engineering, or a related discipline.

• 3-5 years of cybersecurity, security operations, or incident response experience.
• At least 2 years of hands-on SOC or cybersecurity operations experience.
• Experience supporting and coordinating security incidents throughout the response lifecycle.
• Experience investigating security alerts and performing threat triage.
• Experience with API security concepts and security monitoring.
• Exposure to cloud security operations within AWS, Azure, or Google Cloud Platform (GCP).
• Ability to work in a fast-paced, shift-based 24x7 operational environment.

• Cybersecurity Operations
• Security Operations Center (SOC)
• API Security
• Cloud Security Operations
• Identity & Access Management (IAM)
• Security Event Analysis
• SIEM Technologies
• Security Documentation & Reporting

• Experience investigating threats across cloud environments and connected devices.
• Knowledge of vehicle cybersecurity, embedded systems security, or IoT security.
• Experience working with SIEM and SOAR platforms such as:
• Splunk
• QRadar
• Google Sec Ops
• Log Rhythm
• Experience developing or improving runbooks and response playbooks.
• Familiarity with MITRE ATT&CK framework.
• Understanding of automotive cybersecurity concepts and standards:
• ISO/SAE 21434
• UNECE R155
• Experience with alert tuning and detection engineering.
• Security certifications such as:
• Security+
• CySA+
• GIAC Certifications
• AWS Security Specialty
• Azure Security Engineer (AZ-500)
• Google Cloud Security Engineer

The successful candidate will be a SOC Analyst, Security Operations Analyst, Incident Response Analyst, or Cloud Security Analyst with strong experience investigating security incidents and monitoring enterprise environments.

Candidates with experience in API security, cloud security operations, SIEM monitoring, and threat detection will be highly preferred. Automotive cybersecurity experience is a plus but not mandatory. Individuals who demonstrate a strong willingness to learn connected vehicle security and embedded systems will also be considered.

• SOC Analyst II / III
• Security Operations Analyst
• Cybersecurity Analyst
• Cyber Defense Analyst
• Cloud Security Analyst
• Product Security Analyst
• Detection & Response Analyst
• Security Monitoring Analyst
• API Security Analyst
• Automotive Cybersecurity Analyst
• Security Engineer (Operations)

Job Number: 331986

Location: Allen Park, MI (Fairlane Business Park III)

Pay Rate: $48 -…