Cybersecurity Threat Hunter II

• Independently conduct hypothesis-driven threat hunts across available enterprise telemetry to identify malicious or anomalous activity not detected by automated controls
• Proactively analyze security telemetry to identify indicators of compromise, anomalous behavior, and adversary activity that has not met an incident threshold or has evaded automated security controls
• Assess and correlate data from multiple sources, including network, endpoint, identity, SIEM, threat intelligence, vulnerability, and other available security data
• Document hunt activity, findings, evidence, and recommended follow-on actions in authorized systems and initiate or support incident-response processes when malicious activity is identified
• Provide relevant findings and trends for SOC operational reporting, significant-activity reporting, and defensive awareness
• Develop hunt hypotheses based on threat intelligence, adversary TTPs, environmental observations, emerging threats, and known detection gaps
• Use MITRE ATT&CK and other threat-informed methodologies to characterize observed behavior and guide analytical pivots
• Identify patterns, relationships, and potential adversary activity across users, hosts, network segments, and time periods
• Recommend new or improved detections, data collection, enrichment, and defensive controls based on hunt outcomes

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph, * Bachelor’s degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree

• Minimum four (4) years of relevant experience in addition to education level
• Hands-on experience with threat hunting, security analysis, incident investigation, threat intelligence analysis, or comparable proactive cyber defense work
• Working knowledge of adversary TTPs, MITRE ATT&CK, network and endpoint telemetry, and analytical search techniques
• Experience using SIEM, network-security monitoring, endpoint telemetry, or other large-scale security data sources
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph