CSOC Hunt Analyst: Proactive Threat Detection

Cybersecurity Jobs; Chantilly (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

Cybersecurity Jobs in Chantilly, VA is recruiting a CSOC Hunt Analyst to monitor and triage security events in a customer-focused CSOC environment, with hands-on work on Microsoft Sentinel and Splunk Enterprise Security.

This on-site role requires active TS/SCI with Polygraph and DoD 8140/8570, with opportunities to refine hunts, develop queries, and improve telemetry through Cribl Stream/Edge.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, or Cybersecurity, plus 5+ years of related technical experience. Alternatively, High School/GED with 7+ years of related technical experience.
• Experience performing alert triage, initial incident investigation, and writing or troubleshooting basic-to-intermediate SPL and KQL queries.
• Demonstrated ability to filter, summarize, correlate, and analyze time-based security data across endpoint, identity, network, and cloud audit logs.
• Understanding of telemetry pipeline concepts including onboarding, normalization, parsing, routing, enrichment, and field mapping.
• Experience creating, maintaining, and communicating complex technical documentation, including standard operating procedures, investigation notes, and playbooks.
• Must meet applicable DoD 8140/8570 workforce requirements, including an active IAT Level II certification (examples: Security+ CE, CySA+, GSEC, CCNA Security, CASP+ CE).
• Active TS/SCI with Polygraph is required.
• Physical requirements: remain stationary 50% of the time, occasionally move about inside the office to access file cabinets and office machinery.
• Frequent communication with coworkers, management, and customers, which may include delivering presentations, with the ability to exchange accurate information.

Responsibilities

• Monitor, acknowledge, investigate, and triage incidents and alerts across Microsoft Sentinel and Splunk Enterprise Security.
• Write and modify SPL and KQL queries to hunt for suspicious activity, support investigations, and analyze time-based security data.
• Support legacy Splunk operations while assisting with migration efforts for use cases, detections, telemetry, dashboards, and workflows to Microsoft Sentinel.
• Analyze telemetry flows through pipeline platforms such as Cribl Stream or Cribl Edge into SIEM systems, including identifying missing or malformed telemetry.
• Support detection engineering by testing correlation searches and analytic rules, validating expected results, and documenting false positives and false negatives.
• Participate in threat hunts, cyber exercises, tabletop events, and detection-validation activities, using approved AI-assisted tools to enhance research and workflows.
• Maintain system baselines and configuration management items, including security event monitoring policies, standard operating procedures, and playbooks.

Skills

SPL

KQL

Microsoft Sentinel

Splunk ES

Threat hunting

Telemetry analysis

Documentation

Incident response

Education

Bachelor’s degree in CS/IT/CYBER

High School/GED + 7+ years

Tools

Microsoft Sentinel

Splunk Enterprise Security

Cribl Stream

Cribl Edge

SPL

KQL

Job description

Cybersecurity Jobs in Chantilly, VA is recruiting a CSOC Hunt Analyst to monitor and triage security events in a customer-focused CSOC environment, with hands-on work on Microsoft Sentinel and Splunk Enterprise Security.

This on-site role requires active TS/SCI with Polygraph and DoD 8140/8570, with opportunities to refine hunts, develop queries, and improve telemetry through Cribl Stream/Edge.