Advanced Threat Hunter-Public Trust Clearance required

Job Title: Advanced Threat Hunter $85,000-$95,000 Position Summary The Advanced Threat Hunter is responsible for proactively identifying, investigating, and disrupting advanced cyber threats before they impact enterprise operations. This role conducts continuous threat hunting activities across enterprise environments, leveraging endpoint, network, cloud, and security telemetry to identify adversary tactics, techniques, and procedures (TTPs) that evade traditional security controls. The ideal candidate possesses extensive experience in threat hunting, detection engineering, incident investigation, and adversary emulation.

This individual develops hunt hypotheses, creates and refines detection analytics, and collaborates closely with Threat Intelligence, Security Operations, Incident Response, and Security Engineering teams. A key responsibility of this role is producing technical findings, indicators, and contextual analysis that inform enterprise threat intelligence reporting and improve the organization's overall detection capabilities.

Key Responsibilities

Advanced Threat Hunting Conduct continuous, intelligence-driven threat hunting activities across enterprise networks, endpoints, cloud environments, and security platforms. Develop hunt hypotheses based on emerging threats, threat intelligence, adversary behaviors, and organizational risk. Identify advanced persistent threats (APTs), insider threats, malware activity, lateral movement, credential abuse, and other malicious behaviors before they result in security incidents.

Continuously adjust hunting priorities based on changes in the threat landscape, emerging vulnerabilities, and organizational priorities. Detection Engineering Develop, test, and refine detection logic supporting proactive threat identification. Create and maintain a Threat Hunt Analytics Library containing reusable hunt queries, detection methodologies, and investigative procedures.

Improve existing detection capabilities by identifying gaps in security monitoring and recommending enhancements. Collaborate with Security Engineering teams to implement new detections and improve security telemetry coverage. Investigation Analysis Analyze security telemetry from endpoint, network, cloud, identity, and application security tools to identify suspicious activity.

Investigate anomalous behavior using multiple data sources to determine adversary presence and attack progression. Validate findings through technical analysis and document investigative results. Perform root cause analysis and identify opportunities to improve organizational cyber defenses.

Threat Intelligence Collaboration Partner closely with Cyber Threat Intelligence analysts by providing technical findings, indicators of compromise (IOCs), indicators of attack (IOAs), adversary behaviors, and emerging attack trends. Produce technical intelligence that supports operational reporting, strategic intelligence products, and executive briefings. Assist Threat Intelligence teams in correlating hunt findings with external intelligence sources.

Contribute technical context that enhances organizational awareness of emerging cyber threats. Security Operations Support Collaborate with Security Operations Center (SOC), Incident Response, Vulnerability Management, and Security Fusion Center teams to rapidly address identified threats. Ensure findings are tracked through remediation and validated upon completion.

Identify detection gaps and recommend improvements to security controls, monitoring, and defensive capabilities. Support response activities involving advanced threats and complex cybersecurity investigations. Artificial Intelligence Automation Utilize AI-enabled threat hunting technologies to improve the speed and effectiveness of threat detection and investigation.

Evaluate automation opportunities that improve hunt execution, alert triage, and investigative workflows.