McKesson

McKesson

Cyber Threat Detection & Response Analyst

USA, VA, Richmond · Mid · Internship

Sponsorship not specifiedDetected 112 days ago
PythonBashPowerShellAWSGCPAzureCloud PlatformsLinuxDevOpsCybersecuritySIEMKQLSOARSOC OperationsDetection EngineeringIncident ResponseFirewallResearchLeadershipCommunicationCollaborationAdaptabilityOrganizational Skills

Stay score

odds of building a lasting career here

42Risky
Cap-exempt (no lottery)0
Sponsors this role100
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Green-card filing pattern in this occupation

Context, not a finding about this posting: of this employer's 34 green-card filings in this occupation, 100% were for a worker who already held the job.

Green-card follow-through: 81%

Of 21 labor certifications old enough to have been used, 4 expired without the employer filing the next step. Median time from filing to decision: 484 days.100% of their filings were for a worker who already held the job.Only certifications past the 180-day window are counted — recent ones cannot have expired yet.

Files H-1B transfers

4 transfer filings in the last year, covering 4 workers. Median labor-condition decision: 22 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • The Cybersecurity Threat Detection & Response (TDR) Analyst is responsible for implementing and supporting detection engineering and response enablement solutions.

Responsibilities

  • Implement and maintain log/telemetry collection for security monitoring (endpoints, network devices, cloud services, identity systems, and applications) following documented standards and change-management procedures.
  • Create, implement, and tune detection rules and alerts (SIEM/EDR/XDR) to improve fidelity and reduce noise
  • document logic, assumptions, and expected outcomes.
  • Support alert triage and incident response by collecting logs/evidence, assisting with containment/eradication tasks, and coordinating engineering fixes (e.g., telemetry gaps, detection improvements) as directed.
  • test and validate playbook changes in partnership with SOC/IR.
  • Develop and execute test plans for detections and response workflows (use-case testing, regression checks)
  • Work with security operations, infrastructure, and application teams to resolve telemetry issues, implement secure logging configurations, and support remediation of security findings.
  • Perform other duties as assigned.
  • Create, implement, and tune detection rules and alerts (SIEM/EDR/XDR) to improve fidelity and reduce noise; document logic, assumptions, and expected outcomes.
  • Assist with automation and orchestration use cases (SOAR/playbooks) to streamline repetitive response tasks; test and validate playbook changes in partnership with SOC/IR.

Requirements

  • Degree or equivalent and typically requires 4+ years of relevant experience
  • 4+ years of experience in cybersecurity and/or IT operations with exposure to security monitoring, detection engineering, incident response, or SOC-supporting engineering (internship/co-op experience
  • Experience supporting or implementing monitoring/detection tooling such as SIEM, EDR, IDS/IPS, logging agents/collectors, or vulnerability scanners
  • Working knowledge of security monitoring technologies such as SIEM, EDR/XDR, IDS/IPS, firewalls, and threat intelligence feeds
  • familiarity with ticketing/case management workflows.
  • Experience onboarding or supporting log sources and telemetry pipelines (e.g., Windows/Linux logs, network device logs, cloud logs) including basic parsing/normalization concepts.
  • Familiarity with one or more cloud platforms (AWS, Azure, or GCP) and cloud logging/monitoring concepts (IAM signals, audit logs, flow logs, and service logs).
  • Familiarity with security frameworks and standards (e.g., NIST, CIS Benchmarks) and the importance of adhering to security policies and standard operating procedures.
  • Bachelor's degree in computer science, information security/assurance, MIS, engineering, or related field

Nice to have

  • Track record of acting with integrity, being curious and adaptable, and continuously improving technical skills
  • familiarity with basic adversary concepts (e.g., MITRE ATT&CK, kill chain fundamentals) is a plus.

Compensation

  • We will also continue to be one of the largest medical-surgical distributors in the U.S., with over $11B in annual sales.

Benefits

  • Support SIEM and related detection platforms by onboarding data sources, validating parsing/normalization, maintaining data integrity, and monitoring platform health and capacity.
  • Develop and execute test plans for detections and response workflows (use-case testing, regression checks); identify gaps and recommend enhancements to improve coverage and reliability.

Company info

  • We are known for delivering insights, products, and services that make quality care more accessible and affordable.
  • If you want to be part of tomorrow's health today, we want to hear from you.
  • This separation would accelerate our mission and empower us to shape a future defined by customer-centricity, bold thinking and operational excellence.
Apply directly at McKesson →Create a free account for alerts like thisView McKesson immigration profile

This listing is sourced directly from McKesson's careers page and normalized into a canonical job model.