Threat Hunter​/Purple Team Operator

Threat Hunter / Purple Team Operator

SIXGEN's mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and leading technical capabilities to uncover vulnerabilities, protect vital systems, and strengthen operational resilience.

• Position:
  Mid-Level Threat Hunter / Purple Team Operator
• Job Type: Full Time
• Location:
  
  Remote with travel to customers and test locations as required
• Clearance Requirement:
  Active Top Secret with SCI eligibility

SIXGEN is seeking a mid-level Threat Hunter / Purple Team Operator to identify threats that evade existing detection methods, develop and test hunting hypotheses, and feed findings back into detection engineering. This role will combine remote threat hunting and on-site purple team coordination in direct support of red team engagements to secure systems, strengthen the defenders, and build and validate detection methods that can catch offensive traffic in real time.

This role requires comfort working independently through remote hunts as well as the ability to translate adversary tradecraft into defensive guidance.

• Conduct hypothesis-driven and intelligence-led threat hunts across endpoints, networks, and cloud telemetry for several weeks prior to each red team engagement.
• Analyze logs, alerts, and historical data for indicators of compromise (IOCs), anomalous behavior, and adversary TTPs mapped to the MITRE ATT&CK from partner-provided sources (EDR, SIEM, authentication/identify logs).
• Document hunt coverage and methodology, findings, detection recommendations, and any confirmed or suspected compromise, escalating immediately if active adversary activity is found.
• Deliver a threat hunt summary and determine if the customer environment is clear prior to red team assessments.
• Partner with blue teams during the purple portion of the engagement to assist in detecting, tuning, and validating controls against red team TTPs in real-time.
• Brief technical and non-technical stakeholders on hunt result and purple team detection outcomes.
• Serve as a Trusted Agent during the red team assessment and maintain strict confidentiality and operational security with insight into both red and blue team activity.

• SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic).
• EDR/XDR tooling (e.g. Crowd Strike Falcon, Microsoft Defender for Endpoint, Sentinel One, Carbon Black).
• Network detection and traffic analysis tools (e.g. Zeek, Suricata, full packet capture).
• Log aggregation and correlation across endpoint, network, cloud, and identity sources (e.g., Azure AD/Entra , AWS Cloud Trail, Microsoft 365).
• MITRE ATT&CK framework for mapping hunts and detections to adversary TTPs.
• Query and scripting languages for hunting and automation (e.g. KQL, SPL, Python).
• Familiarity with common red team tooling and tradecraft (e.g., Cobalt Strike, Havoc, and other C2 traffic patterns) to help recognize and detect it.

• 3-5+ years of experience in threat hunting, SOC/detection engineering, incident response, or a closely related defensive security role.
• Hand-on experience working with a major SIEM and EDR platform.
• Working knowledge of the MITRE ATT&CK framework and how to map observed activity to adversary TTPs.
• Understanding of common adversary tradecraft and red team testing methodology to help close detection gaps.
• Strong written and verbal communication skills with the ability to produce clear, customer-facing findings and an "all clear" determination.
• Comfortable operating independently in remote, customer-facing roles.
• U.S. citizenship, with eligibility to obtain and maintain a U.S. government security clearance.

• Industry certifications such as GCFA, GCIH, GNFA, GCTI, CySA+, or equivalent.
• Prior experience performing threat hunting and/or purple team role working directly alongside a red team.
• Scripting and automation experience to streamline hunting workflows (e.g., Python, Power Shell).
• Prior experience working with multiple partner organizations or client environments.
• Active TS/SCI clearance.

SIXGEN offers competitive compensation based on the responsibilities of the role and the candidate's experience, qualifications, specialized expertise, and security-clearance status. The final compensation package will be discussed…