> Markdown version of [/jobs/ext/2374016-cyber-threat-analyst](https://www.wearedevelopers.com/jobs/ext/2374016-cyber-threat-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Threat Analyst - **Company:** Everforth Ecs - **Location:** Fairfax, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Amazon Web Services, Microsoft Azure, Big Data, Software as a Service, Cloud Computing, Cloud Engineering, Cyber Security, Query Languages, Linux, Domain Name System (DNS), Emulators, Intrusion Detection and Prevention, Virtual Private Networks (VPN), Python (Programming Language), Open Source Technology, Windows PowerShell, Kusto Query Language, Security Information and Event Management, Cloud Platform System, Cloud Monitoring, Mitre Att&ck, QRadar, Malware, Cyber Threat Analysis, HybridCloud, Firewalls (Computer Science), Azure Security Center, Kubernetes, Information Technology, Microsoft Sentinel, Web Technologies, Purple Team (Cyber Security), Cyber Warfare, Splunk, SentinelOne Expertise, Security Orchestration, Automation & Response - **Published:** August 28, 2026 - **Apply:** https://www.dice.com/job-detail/7547782d-8800-4f88-8ee5-f6cfaf42f789 ## About the Role * US. Citizenship with the ability to obtain and maintain a Secret Security Clearance. * Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field. Relevant experience may be substituted for education. * Minimum of 5 years of cybersecurity experience . * Minimum of 3 years supporting Security Operations Center (SOC), MSSP, MDR, Incident Response, Threat Detection, or Cyber Defense operations. * Strong understanding of modern attacker methodologies, threat actor tactics, techniques, and procedures (TTPs), and attack lifecycles. * Experience investigating cybersecurity incidents from initial detection through containment, eradication, and recovery. * Experience operating enterprise SIEM platforms including Microsoft Sentinel, Elastic, Splunk, QRadar, or equivalent technologies. * Experience with EDR technologies including Microsoft Defender for Endpoint, CrowdStrike Falcon, Trellix, SentinelOne, or equivalent platforms. * Experience with SOAR platforms, case management systems, and security automation technologies. * Experience investigating Microsoft 365, Entra ID, Azure, AWS, or hybrid-cloud environments. * Experience investigating identity-focused attacks including account compromise, privilege escalation, token abuse, suspicious authentication activity, and MFA-related attacks. * Strong understanding of Windows, Linux, networking, DNS, email security, web technologies, and cloud architectures. * Experience analyzing firewall, proxy, VPN, DNS, endpoint, NDR, identity, cloud, and authentication logs. * Experience creating custom detections using KQL, Sigma, SPL, Elastic Query Language, or equivalent detection technologies. * Ability to correlate events from multiple data sources and construct detailed attack timelines. * Ability to perform ad hoc scripting and automation using Python, PowerShell, or similar languages. * Strong written and verbal communication skills. * Ability to independently manage multiple concurrent investigations while meeting customer and operational requirements. Desired Skills * Experience leading cybersecurity investigations during active incidents. * Experience conducting proactive threat hunting activities across large datasets. * Experience with endpoint and cloud forensic artifact analysis. * Experience creating or improving incident response procedures, playbooks, and investigation workflows. * Experience developing automated workflows using SOAR technologies. * Experience supporting multi-tenant MSSP, MDR, consulting, or managed security environments. * Experience validating detections through adversary emulation, purple team activities, or threat simulation exercises. * Familiarity with malware analysis and modern threat intelligence platforms. * Experience supporting cloud-native, containerized, or Kubernetes environments. * Understanding of NIST 800-61, MITRE ATT&CK, Cyber Kill Chain, and modern incident response frameworks. ## Description This position serves as a senior investigator within the Security Operations Center, leading complex investigations, supporting incident response activities, improving detection capabilities, and mentoring junior analysts. The ideal candidate possesses strong investigative and incident response experience, is capable of independently managing complex security events, and can operate effectively in a fast-paced MSSP environment supporting multiple customers simultaneously., * Lead investigations involving malware, ransomware, business email compromise (BEC), account compromise, insider threats, cloud attacks, and advanced persistent threats. * Perform incident response activities including forensic triage, scope determination, evidence collection, containment recommendations, root cause analysis, and post-incident reporting. * Serve as the primary escalation point for Tier 1 analysts during complex investigations and security events. * Manage multiple concurrent customer investigations while meeting service-level objectives and communication requirements. * Coordinate response efforts with customers, IT teams, system administrators, and executive stakeholders. * Develop detailed technical incident reports, executive summaries, and customer-facing communications. * Conduct forensic triage across endpoints, servers, cloud platforms, email environments, and identity providers. * Analyze and correlate telemetry from SIEM, EDR, SOAR, NDR, cloud monitoring platforms, identity providers, email security tools, and threat intelligence sources. * Recommend, validate, test, and optimize detection content aligned with MITRE ATT&CK techniques and observed adversary behavior. * Conduct targeted threat hunts based on intelligence requirements, active investigations, or emerging threats, and contribute findings to detection improvement efforts. * Investigate security events across on-premises, cloud, SaaS, endpoint, network, and identity environments. * Analyze attacker behavior and map observed activity to MITRE ATT&CK techniques to support reporting, threat tracking, and investigation activities. * Utilize commercial and open-source threat intelligence to enrich investigations and identify emerging threats. * Collaborate with Detection Engineering and SOAR teams to improve alert fidelity, reduce false positives, and increase operational efficiency. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Discover the open source trio you didn’t expect: .NET and PostgreSQL on Linux](https://www.wearedevelopers.com/videos/2042-discover-the-open-source-trio-you-didn-t-expect-net-and-postgresql-on-linux) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)