Intrusion Analyst III

Position Summary...

What you'll do...

Job Summary As a SOC Analyst, you will monitor, detect, analyze, investigate, and support remediation of cybersecurity events in accordance with established standard operating procedures.

You will combine hands-on security operations expertise with data-driven investigation, automation, and responsible use of AI/Generative AI to improve analyst effectiveness, detection quality, investigation consistency, and response outcomes.

The role requires close collaboration with stakeholders, engineering teams, incident responders, and business units across a global operating environment.

About the Team The Information Security organization helps protect Walmart’s customers, associates, information assets, and technology environment.

SOC Incident Management is a centralized security operations function responsible for monitoring, detecting, analyzing, investigating, escalating, and responding to security threats.

Analysts work alongside security engineers, incident responders, threat intelligence teams, and other cybersecurity professionals to protect the organization’s information assets and networks.

Key Responsibilities Security Monitoring, Investigation & Incident Response Monitor, triage, analyze, investigate, and support remediation of cyber events using defined SOC procedures, playbooks, escalation paths, and service expectations.

Perform investigation across endpoint, network, email, identity, cloud, Windows, and Linux telemetry; correlate evidence across multiple data sources to determine scope, impact, root cause, and recommended actions.

Run approved commands, queries, scripts, and automation for assigned areas of work while maintaining appropriate operational controls and documentation.

Identify indicators of compromise, suspicious behaviors, attack patterns, and emerging risks; escalate confirmed or high-risk incidents to the appropriate response teams.

Communicate clearly with technical and business stakeholders during troubleshooting and security events, providing timely status, findings, risk context, and recommended next steps.

Detection Engineering & Continuous Improvement Provide actionable input to improve alert logic, correlation rules, detection use cases, thresholds, enrichment, prioritization, and suppression of known false positives.

Identify opportunities for new risk detection based on investigation trends, threat intelligence, recurring incidents, control gaps, and observed attacker behavior.

Partner with engineering and platform teams to validate and operationalize detection improvements across SIEM, EDR, SOAR, email security, firewall, IPS, and cloud security tooling.

Capture investigation learnings, recurring patterns, root causes, and operational gaps; recommend measurable improvements to SOC processes, playbooks, documentation, and analyst workflows.

AI / Generative AI Responsibilities Use approved AI/GenAI capabilities (for example, Copilot, ChatGPT, Gemini, or enterprise-approved equivalents) to assist with investigation summarization, evidence correlation, query/script drafting, threat-context synthesis, case documentation, and recommendation generation.

Critically validate AI-generated analysis against authoritative telemetry and security evidence before using it for incident decisions, escalation, remediation, or stakeholder communication.

Maintain analyst accountability for final conclusions.

Assess the quality of AI-assisted investigations by identifying inaccurate conclusions, missed evidence, weak reasoning, hallucinations, incomplete recommendations, or inconsistent outputs, and provide structured feedback for improvement.

Help develop and refine prompts, analyst workflows, evaluation criteria, test cases, and feedback loops that improve the accuracy, consistency, explainability, and operational usefulness of AI-assisted SOC analysis.

Identify appropriate opportunities to integrate AI/GenAI with SIEM, SOAR, EDR, threat intelligence, case-management, and knowledge-management workflows to reduce repetitive analyst effort and accelerate triage and investigation.

Apply responsible-AI and security principles when using AI tools, including data handling, confidentiality, access controls, human oversight, traceability, and compliance with company policies and approved-use requirements.

Monitor AI-assisted workflows for quality and operational risk, and escalate cases where AI output could create false assurance, inappropriate remediation, data exposure, or other security impact.

Contribute to AI readiness across the SOC by documenting effective practices, sharing lessons learned, and supporting analyst adoption and training for approved AI-enabled capabilities.

Cybersecurity Technology & Solution Support Support cybersecurity intelligence and security-operations solutions by gathering requirements, researching technologies, participating in solution reviews, and contributing to supplier/product evaluations.

Develop and review system, process, investigation, and operational documentation to support consistent execution and knowledge transfer.

Maintain current knowledge of cybersecurity threats, attacker techniques, security technologies, automation, and AI/GenAI developments relevant to SOC operations.

Collaboration, Documentation & Stakeholder Management Participate in team assignments and projects, provide timely progress updates, contribute to team meetings and technical discussions, and support cross-functional initiatives.

Create and review high-quality case notes, standard operating procedures, playbooks, knowledge articles, metrics, reports, and presentations for management, technical teams, customers, suppliers, and other stakeholders.

Build collaborative relationships across functional and organizational boundaries and respond effectively to stakeholder and business-unit requests.

Governance, Ethics & Compliance Operate in accordance with company policies, security standards, procedures, ethical expectations, and app