Cyber Threat Analyst

The Cyber Threat Hunting Analyst serves as a technical lead for threat hunting, focusing on identifying advanced threats that evade traditional security controls. They design and drive hunt campaigns across endpoint, identity, cloud, email, and DNS/proxy data, and own the conversion of those hunts into durable detection and monitoring improvements. The role also provides guidance and mentorship to other hunters and analysts and represents threat hunting in cross-team detection and response strategy discussions.

This is a hands‑on role for an analyst with solid SOC/IR or detection experience who enjoys investigative work more than reacting solely to alerts.

• Lead complex, proactive threat-hunting investigations across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud platforms, email, DNS and web proxy data to uncover previously undetected threats, attacker techniques and misconfigurations that bypass existing controls
• Own the threat-hunting roadmap and backlog, defining and prioritizing hunt topics and maintaining playbooks and use cases based on threat intelligence, recent campaigns, penetration-test findings and knowledge of the environment
• Establish and refine behavioral baselines for key users, systems and applications, using those baselines to distinguish benign anomalies from meaningful indicators of compromise or abuse during hunts and investigations
• Translate successful hunts and identified patterns into detection content (rules, analytics, scheduled searches, watchlists) and lead the testing and tuning of new or updated detections and models with Detection Engineering to ensure effective, low-noise coverage before production rollout
• Collaborate with CTI analysts, SOC/Incident Response and offensive security/pentesters to operationalize intelligence, expand high‑priority investigations and ensure exploited attack paths and high‑risk behaviors are visible and monitored going forward.
• Maintain structured documentation of hunt hypotheses, methods, data sources, findings and outcomes; develop and maintain hunt playbooks and reusable queries; and serve as a technical mentor and escalation point for other hunters and analysts.

• Bachelor’s degree in Cybersecurity, Computer Science

• Master’s degree in Cybersecurity, Computer Science

• 6+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.

• 8+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.

• GCDA, GCIH, SC-200

• Advanced experience leading multi-source threat hunts across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud, email, DNS and web proxy data.
• Strong proficiency with SIEM / log query languages (e.g., KQL, S1QL) and building complex, ATT&CK-aligned hunting queries and analytics.
• Deep understanding of attacker TTPs and the MITRE ATT&CK framework, especially around credential theft, persistence, lateral movement, command and control, and data exfiltration.
• Proven ability to establish and refine behavioral baselines for users, systems and applications, and to use those baselines to distinguish benign anomalies from meaningful indicators of compromise.
• Experience designing, testing and tuning detections and analytics derived from hunt results, including evaluating false-positive/false-negative trade-offs.
• Strong collaboration skills working with CTI, SOC/Incident Response, penetration testers and detection…