About this role
Req Id: 431245Connection is everything. It drives us to innovate, explore, and stay close to what matters to us most. At Bell, we're building a more connected future through world-class networks, AI-powered solutions, and digital experiences that elevate how people live, work, and play every day. We believe in empowering people. That's why we equip our teams with cutting-edge technology, AI tools, and a collaborative environment that supports creativity and growth. Want to be part of a diverse team where your work makes a real impact? If you're inspired by innovation that advances how people connect and transforms what's possible, you belong on #TeamBell.SummaryWe are seeking a Cyber Security Analyst II to join a high-performing Threat Detection & Intelligence team within a large, complex enterprise environment. This role is ideal for professionals who thrive at the intersection of threat intelligence, detection engineering, and proactive cyber defense. In our Defense Centre, we don't simply react to alerts?we analyze emerging threats, simulate adversary tactics, and engineer detection capabilities grounded in real-world attacker behavior. You will play a key role in identifying and assessing evolving threats, translating intelligence into actionable detection content, and continuously strengthening our ability to detect and respond to sophisticated cyber attacks. If you think like an adversary, challenge assumptions, and are passionate about building detection systems?not just monitoring alerts?this is an opportunity to make a meaningful impact on the security of a critical enterprise environment.Key ResponsibilitiesThreat Intelligence & Analysiso Analyze and classify threat reports, campaigns, and attacker behaviors (TTPs)o Track and profile threat actors, motivations, and evolving tradecrafto Transform intelligence into operationalized detections aligned with MITRE ATT&CKo Validate intelligence quality, including AI-assisted outputs and datasetso Support investigations with adversary context, scoping, and attribution insightso Partner with Defence Center, IR, fraud, and engineering teams to improve responseo Provide clear intelligence reporting to both technical and executive audiences Detection Engineering & Platform Integrationo Support the development of value-add detections for our Defense Centre teamso Develop, test, and optimize detections using detection-as-code practiceso Continuously improve detection coverage and reduce false positiveso Build scalable detection pipelines (CI/CD, automated validation, purple teaming)o Design integrations across SIEM, EDR, SOAR, TIPs, and internal telemetryo Engineer data pipelines leveraging Kafka, Elastic, parsing, normalization, and data viewso Develop dashboards and analytics to track threats, coverage, and detection efficacyCritical Qualifications? 5?8+ years in Threat Intelligence, Threat Hunting, or Advanced Cyber Security roles (large enterprise preferred)? Deep knowledge of MITRE ATT&CK, kill chain models, and adversary tradecraft? Strong hands-on experience with: SIEM analytics (Splunk, Sentinel, Elastic, etc.) and Log analysis, correlation, and detection logic development? Solid understanding of networking & infrastructure (TCP/IP, OSI, network telemetry, IDS/IPS)? Experience working with log ingestion pipelines (Kafka, Elastic), including data parsing, normalization, and enrichment? Scripting/automation skills (Python, PowerShell, APIs)? Ability to translate intelligence into detections and measurable outcomes? Experience leading complex investigatioPreferred Qualifications? Threat Intelligence Platform (TIP) experience (IOC lifecycle, STIX/TAXII)? Detection engineering frameworks (Sigma, YARA) and CI/CD pipelines? Cloud security experience (AWS, Azure, GCP) and cloud telemetry? Experience with SOAR automation and playbook development? Exposure to AI/ML-assisted detection or intelligence workflows? Malware analysis, red tea