Cyber Security Analyst Leads – Cyber Threat Hunting

FIS; Jacksonville (FL); On-site; USD 120,000 - 170,000; Full time

Job summary

FIS Management Services, LLC seeks Cyber Security Analyst Leads to drive proactive threat hunting in Jacksonville, FL. You will lead hunts across endpoints, network, identity and cloud telemetry to reduce attack dwell time and improve detections.

You will translate threat intelligence into high-fidelity analytics mapped to MITRE ATT&CK and partner with SOC, Pen Testing, and Detection Engineering to operationalize detections and playbooks. Automation of workflows with scripting will be encouraged.

Qualifications

• Bachelor's degree or equivalent in CS, Cyber Security, Digital Forensics, or related field; 7+ years of relevant experience.
• Alternative: Master's degree with 5 years of relevant experience.
• Experience investigating endpoint threats using EDR solutions; experience tuning and investigating detections in SIEMs.

Responsibilities

• Lead proactive threat hunts across endpoints, network, identity and cloud telemetry.
• Execute complex investigations using EDR and SIEM; correlate evidence and scope, contain, and support remediation.
• Translate threat intel and adversary TTPs into MITRE ATT&CK-aligned detections and durable playbooks.
• Automate hunting workflows with scripting (Python, PowerShell, Bash) to improve speed and signal quality.
• Collaborate with SOC, Penetration Testing Teams and Detection Engineering to operationalize hunts into detections.

Skills

Threat hunting

Endpoint security

SIEM analysis

Education

Bachelor's degree in Computer Science / Cyber Security / Digital Forensics

Master's degree in the listed fields (alternative)

Tools

EDR platforms

SIEM platforms

Python

PowerShell

Bash

Job description

Position Type

Full time

Type Of Hire

Experienced (relevant combo of work and education)

Job Description

FIS Management Services, LLC seeks Cyber Security Analyst Leads - Cyber Threat Hunting in Jacksonville, FL to serve as a technical lead within FIS Cyber Threat Hunting (CTH) program, driving proactive, hypothesis-based threat hunts across endpoint, network, identity and cloud telemetry to uncover stealthy adversary activity leading to reductions in attack dwell time in the FIS environment. Execute complex investigations using enterprise level EDR and SIEM platforms, correlate multi-source evidence and rapidly scope, contain and support remediation for incidents including malware, credential compromise and unauthorized access while clearly documenting hunt outcomes and investigative conclusions. Translate threat intelligence and adversary TTPs into high-fidelity behavioral analytics mapped to frameworks such as MITRE ATT&CK, and you will partner with the Security Operations Center, Penetration Testing Teams and Detection Engineering stakeholders to operationalize successful hunts into durable detections and improved response playbooks. Automate and scale hunting and investigative workflows through scripting languages (PowerShell/BASH), enrichment and data analysis to improve speed, consistency and signal quality. Lead threat hunting efforts in newly acquired or integrating M&A environments, where you will be required to rapidly assess unfamiliar architectures, establish baselines, and identify inherited risk and latent compromise. Hunt for pre- and post-acquisition adversary activity while informing integration and risk-reduction strategies.

Requirements

Bachelor's degree or foreign equivalent in Computer Science, Cyber Security, Digital Forensics, or related field and seven (7) years of progressively responsible experience in the job offered or a related occupation: investigating endpoint-based security threats using enterprise Endpoint Detection and Response (EDR) solutions, including analysis of behavioral detections, process execution trees, command-line activity, and persistence mechanisms to identify and contain malicious activity; developing, tuning, and investigating security detections using SIEM platforms in an enterprise environment, including analysis of authentication logs, endpoint telemetry, network events, and cloud audit logs; supporting cybersecurity incident response activities, including triage, scoping, containment, and remediation of incidents including malware infections, credential compromise, and unauthorized access; utilizing scripting languages including Python, PowerShell, and Bash to automate security workflows, analyze security data, enrich security alerts, or support incident investigations; and consuming and applying threat intelligence, including indicators of compromise (IOCs), adversary tactics and techniques, and open-source intelligence, to enhance security detections and investigations. In the alternative, the employer will accept a Master's degree in the above listed fields and five (5) years of experience in the above listed skills. Telecommuting and/or working from home may be permissible pursuant to company policies.

Qualified Applicants

Please apply directly through our website by clicking on "Apply Now".

Privacy Statement

FIS is committed to protecting the privacy and security of all personal information that we process in order to provide services to our clients. For specific information on how FIS protects personal information online, please see the Online Privacy Notice.

EEOC Statement

FIS is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, marital status, genetic information, national origin, disability, veteran status, and other protected characteristics. EEO is the Law poster is available here supplement document available here.

Other Conditions

For positions located in the US, the following conditions apply. If you are made a conditional offer of employment, you will be required to undergo a drug test. ADA Disclaimer: In developing this job description care was taken to include all competencies needed to successfully perform in this position. However, for Americans with Disabilities Act (ADA) purposes, the essential functions of the job may or may not have been described for purposes of ADA reasonable accommodation. All reasonable accommodation requests will be reviewed and evaluated on a case-by-case basis.

Sourcing Model

Recruitment at FIS works primarily on a direct sourcing model; a relatively small portion of our hiring is through recruitment agencies. FIS does not accept resumes from recruitment agencies which are not on the preferred supplier list and is not responsible for any related fees for resumes submitted to job postings, our employees, or any other part of our company.