Signals and Defense Engineer, Mid

As a Security Operations and Threat Hunt Analyst, you will investigate security events and incidents while proactively searching for malicious activity that may not have been identified through existing security controls. This position combines traditional incident response responsibilities, including triage, investigation, containment, eradication, and recovery, with hypothesis-driven threat hunting designed to identify adversary behaviors, uncover detection gaps, and improve overall security visibility.

The ideal candidate is a technically capable cybersecurity professional who can independently conduct investigations while collaborating with senior analysts, threat hunters, detection engineers, and incident responders during complex events. Due to the nature of work performed within this facility, U.S. citizenship is required.

• Investigate security alerts, suspicious activity, and potential cybersecurity incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
• Perform incident triage and determine the scope, severity, impact, and potential root cause of identified security events.
• Support containment, eradication, and recovery activities during cybersecurity incidents in coordination with incident response, infrastructure, cloud, and application teams.
• Conduct proactive threat hunts using threat intelligence, adversary behaviors, emerging attack techniques, anomalous activity, and identified gaps in existing security monitoring.
• Develop and execute threat hunting hypotheses aligned to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
• Analyze large volumes of security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
• Use SIEM, EDR/XDR, network security, cloud security, threat intelligence, and analytics platforms to support investigations and hunting activities.
• Assist with cloud-based hunting and investigations across environments such as AWS, Azure, and GCP, including analysis of cloud audit logs, identity activity, workloads, and container environments.
• Translate investigation and threat hunting findings into actionable detection opportunities for detection engineering and SOC monitoring teams.
• Develop, test, and recommend new detection logic or enhancements to existing alerts based on identified attacker behaviors and investigative findings.
• Identify visibility, telemetry, and detection gaps uncovered through incidents and threat hunts, and work with partner teams to improve security coverage.
• Leverage automation, artificial intelligence (AI), machine learning, and analytical tools where appropriate to accelerate investigations, correlate large datasets, identify anomalies, and improve analyst efficiency.
• Collaborate with cyber threat intelligence to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunting activities.
• Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response activities.
• Document investigation findings, timelines, threat hunting methodologies, evidence, conclusions, and recommended remediation actions.
• Contribute to the development and continuous improvement of incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures.
• Participate in post-incident reviews and lessons-learned activities to identify opportunities for improving detection, response, telemetry, automation, and security controls.
• Communicate technical findings clearly to both technical and non-technical stakeholders.

Join us. The world can’t wait.

• 1+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations
• Experience conducting hypothesis-driven threat hunts to identify suspicious or malicious activity that may not be detected through existing security controls
• Experience with adversary tactics, techniques, and procedures, including practical application of the MITRE ATT&CK framework to guide hunt development and investigative analysis
• Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise, anomalous behavior, and potential attack activity
• Experience using SIEM, EDR/XDR, or…