Cyber Defense Hunt Analyst — CSOC Specialist

MANTECH; Chantilly (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

MANTECH seeks a motivated, career- and customer-oriented Cybersecurity Operations Center Hunt Analyst to join our team in Chantilly, VA. The role focuses on proactive threat hunting, incident triage, and documenting findings to support a secure customer environment.

The analyst will monitor Microsoft Sentinel and Splunk environments, write SPL/KQL queries, and participate in threat hunts and tabletop exercises to strengthen defense capabilities.

Qualifications

• Bachelor’s degree in a technical field or equivalent experience.
• 5+ years of related technical experience; or 7+ years with HS/GED.
• Experience with cybersecurity alert triage and initial investigations.
• Proficiency filtering, summarizing, and analyzing time-based security data.

Responsibilities

• Monitor, acknowledge, investigate, and triage incidents across SIEM environments.
• Write and refine SPL and KQL queries to hunt for threats.
• Support migration from Splunk to Microsoft Sentinel and maintain telemetry.
• Analyze telemetry through pipelines and identify missing or malformed data.
• Assist with detection engineering, validation, and documenting false positives/negatives.
• Participate in threat hunts, exercises, and AI-assisted tooling usage.
• Maintain baselines, policies, and playbooks.

Skills

Incident triage

SPL/KQL queries

Security analytics

Documentation

Communication

Education

Bachelor’s degree in Computer Science / IT / Cybersecurity

Alternate: HS diploma with 7+ years of experience

Tools

Microsoft Sentinel

Splunk Enterprise Security

Cribl Stream/Edge

SIEM platforms

Job description

MANTECH seeks a motivated, career- and customer-oriented Cybersecurity Operations Center Hunt Analyst to join our team in Chantilly, VA. The role focuses on proactive threat hunting, incident triage, and documenting findings to support a secure customer environment.

The analyst will monitor Microsoft Sentinel and Splunk environments, write SPL/KQL queries, and participate in threat hunts and tabletop exercises to strengthen defense capabilities.