> Markdown version of [/jobs/ext/2793322-cybersecurity-threat-hunter-ii](https://www.wearedevelopers.com/jobs/ext/2793322-cybersecurity-threat-hunter-ii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cybersecurity Threat Hunter II

- **Company:** Invictus Inc.
- **Location:** Colorado Springs, CO, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Identity and Access Management, Network Security, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Cyber Warfare
- **Published:** September 8, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9148811/cybersecurity-threat-hunter-ii

## About the Role

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph, * Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree

 * Minimum four (4) years of relevant experience in addition to education level
 * Hands-on experience with threat hunting, security analysis, incident investigation, threat intelligence analysis, or comparable proactive cyber defense work
 * Working knowledge of adversary TTPs, MITRE ATT&CK, network and endpoint telemetry, and analytical search techniques
 * Experience using SIEM, network-security monitoring, endpoint telemetry, or other large-scale security data sources
 * Must possess current DoD 8570 IAT II or IAM II certification
 * Experience working in a DoD or IC environment
 * Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

## Description

* Independently conduct hypothesis-driven threat hunts across available enterprise telemetry to identify malicious or anomalous activity not detected by automated controls
 * Proactively analyze security telemetry to identify indicators of compromise, anomalous behavior, and adversary activity that has not met an incident threshold or has evaded automated security controls
 * Assess and correlate data from multiple sources, including network, endpoint, identity, SIEM, threat intelligence, vulnerability, and other available security data
 * Document hunt activity, findings, evidence, and recommended follow-on actions in authorized systems and initiate or support incident-response processes when malicious activity is identified
 * Provide relevant findings and trends for SOC operational reporting, significant-activity reporting, and defensive awareness
 * Develop hunt hypotheses based on threat intelligence, adversary TTPs, environmental observations, emerging threats, and known detection gaps
 * Use MITRE ATT&CK and other threat-informed methodologies to characterize observed behavior and guide analytical pivots
 * Identify patterns, relationships, and potential adversary activity across users, hosts, network segments, and time periods
 * Recommend new or improved detections, data collection, enrichment, and defensive controls based on hunt outcomes


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)