Senior Embedded Detection Analyst

Role Description

Abnormal AI is looking for an Embedded Detection Analyst to join our Threat Intelligence team. The Embedded Detection Program partners directly with our highest-value customers to rapidly identify, resolve, and demonstrate measurable improvements in detection performance. This role combines the investigative mindset of a SOC analyst with the customer-focused approach of a detection engineer—you'll own end-to-end customer outcomes by understanding pain points, using our detection analysis platform to identify root causes, implementing tuning solutions, and validating improvement.

The ideal candidate will bring:

• SOC or security operations experience
• Strong analytical skills
• Hypothesis-driven investigation approaches
• Ability to work systematically with established tools and processes

You will work at the intersection of security operations, customer success, and detection quality, using our suite of analysis tools and AI-powered productivity enhancers to drive measurable customer value while contributing to the operational playbook that scales this program.

Scope and scale:

• Own detection performance outcomes for 3-5 strategic customer accounts
• Responsibility for measurable detection KPIs
• Cross-customer tuning patterns
• Contributions to the program's playbook

As an Embedded Detection Analyst, you are a trusted technical partner for our strategic customers. You are highly motivated to understand:

• What attackers are doing
• Why detections are behaving unexpectedly
• How to systematically improve customer outcomes

You will:

• Dive into the details of complex detection systems
• Investigate systematically until issues are identified
• Document investigations clearly for future reference
• Communicate technical detection issues to both technical and non-technical audiences
• Remain calm and responsive during high-pressure situations
• Operate behind the scenes, partnering closely with GTM and customer-facing teams
• Measure success by quantified detection improvements

Qualifications

• 7+ years of experience in SOC operations, detection engineering, incident response, email security analysis, or related cybersecurity role
• Experience with security monitoring and detection platforms such as SIEM, EDR, email security tools, or similar technologies
• Experience in email attack analysis, with ability to identify and leverage IOCs and TTPs
• Deep understanding of precision/recall metrics and their business impact
• Proven experience triaging security alerts and tuning detection logic
• Ability to perform standardized data analysis procedures
• Demonstrated proficiency with AI tools to enhance productivity
• Experience in technical writing that effectively communicates complex issues
• Proven ability to work directly with customers on technical security issues
• Demonstrated ability to remain calm during high-pressure situations
• Outcome-oriented mindset
• Strong ownership mentality

Requirements

• Background in email security, phishing detection, anti-abuse systems, spam analysis, or email threat containment
• Basic SQL knowledge with ability to write simple queries
• Familiarity with Python, data analysis scripting, or notebook environments
• Understanding of threat intelligence, IOCs, and threat hunting concepts
• Familiarity with the MITRE ATT&CK framework and common email attack vectors
• Security certifications such as Security+, Network+, GIAC, CISSP, CEH, or similar
• Previous experience in technical account management or customer-facing security roles
• Examples of using AI tools and automation to solve security problems
• Experience documenting investigation methodologies and training team members

Benefits

• Base salary range: $167,210 — $240,350 USD
• Bonus or incentive compensation
• Equity
• Comprehensive benefits package