Security Analyst

About Artemis

Artemis is building the future of AI-driven defense, helping companies detect and defend themselves effectively as AI transforms the cyber battlefield. Backed by First Round Capital and Brightmind, the company was founded by security veterans from Palo Alto Networks, AWS, Demisto, Abnormal Security, and Twitter. The team includes talent from Google, Abnormal AI, Wiz, Meta, AWS, CERN, and SentinelOne.

Role Overview

Join as a Security Analyst at the core of our operations: reviewing real security cases across customer environments, recommending outcomes, and continuously improving the detection logic that powers our platform. This role sits at the intersection of hands-on SOC work and modern AI-assisted security operations. You'll develop deep expertise in cloud, identity, and SaaS threats while directly shaping the detection content and investigation workflows that protect our customers.

Key Responsibilities

• Review and triage security cases – Investigate alerts and cases across cloud, identity, endpoint, and SaaS environments. Analyze logs and evidence to determine if activity is malicious, benign, or a false positive.
• Recommend and document case outcomes – Provide clear verdicts (true positive, false positive, benign confirmed) with supporting evidence and written justifications for customer reports and product improvement.
• Build and refine detections – Write new detection logic and tune existing rules to improve signal quality, reduce noise, close coverage gaps, and surface threats that matter.
• Fix and maintain the detection library – Identify misfiring or noisy detections through case review and own the quality of detection content from triage through shipment.
• Conduct threat hunting – Proactively investigate customer environments for attacker activity missed by automated detections using hypothesis-driven hunting and AI-assisted workflows.
• Investigate security incidents – Perform deeper triage on escalated or complex cases, piecing together attacker timelines and identifying lateral movement, persistence, or exfiltration across data sources.