Cyber Threat Hunting Analyst

FreshPoint Oahu, Ltd. (FreshPoint Hawaii, LLC); United States; On-site; USD 140,000 - 190,000; Full time

Job summary

US6469 Sysco Payroll, Division of Sysco Resources Services, LLC is seeking a Cyber Threat Hunting Analyst to lead proactive hunts across EDR, SIEM, identity, cloud, and network data, turning findings into durable detections and playbooks.

You will mentor other hunters, guide detection engineering efforts, and partner with CTI and incident response to strengthen defenses against advanced threats.

Qualifications

• Bachelor's degree in Cybersecurity or Computer Science.
• 6+ years in SOC/IR/detection hunting roles with demonstrable security telemetry analysis.
• 8+ years of related experience preferred.
• GCDA, GCIH, SC-200 certifications preferred.

Responsibilities

• Lead complex threat-hunting investigations across EDR, SIEM/log analytics, identity, cloud, email, DNS and web proxy data.
• Own the threat-hunting roadmap and backlog, defining hunt topics and maintaining playbooks.
• Establish and refine behavioral baselines for users, systems and apps.
• Translate successful hunts into detection content and lead testing/tuning with Detection Engineering.
• Collaborate with CTI analysts, SOC/IR and pentesters to operationalize intelligence.

Skills

Threat hunting

EDR

SIEM

KQL

ATT&CK

Mentoring

Documentation

Education

Bachelor's degree in Cybersecurity

Bachelor's degree in Computer Science

Master's degree in Cybersecurity or Computer Science

Tools

Azure AD

Active Directory

GCDA

GCIH

SC-200

Job description

Company: US6469 Sysco Payroll, Division of Sysco Resources Services, LLC

Sales Territory: None

Zip Code: 77077

Travel Percentage: 0

COMPENSATION INFORMATION:The pay range provided is not indicative of Sysco's actual pay range but is merely algorithmic and provided for generalized comparison. Factors that may be used to determine rate of pay include specific skills, work location, work experience and other individualized factors

Job Summary

The Cyber Threat Hunting Analyst serves as a technical lead for threat hunting, focusing on identifying advanced threats that evade traditional security controls. They design and drive hunt campaigns across endpoint, identity, cloud, email, and DNS/proxy data, and own the conversion of those hunts into durable detection and monitoring improvements. The role also provides guidance and mentorship to other hunters and analysts and represents threat hunting in cross-team detection and response strategy discussions. This is a hands-on role for an analyst with solid SOC/IR or detection experience who enjoys investigative work more than reacting solely to alerts.

Duties and Responsibilities

• Lead complex, proactive threat-hunting investigations across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud platforms, email, DNS and web proxy data to uncover previously undetected threats, attacker techniques and misconfigurations that bypass existing controls
• Own the threat-hunting roadmap and backlog, defining and prioritizing hunt topics and maintaining playbooks and use cases based on threat intelligence, recent campaigns, penetration-test findings and knowledge of the environment
• Establish and refine behavioral baselines for key users, systems and applications, using those baselines to distinguish benign anomalies from meaningful indicators of compromise or abuse during hunts and investigations
• Translate successful hunts and identified patterns into detection content (rules, analytics, scheduled searches, watchlists) and lead the testing and tuning of new or updated detections and models with Detection Engineering to ensure effective, low-noise coverage before production rollout
• Collaborate with CTI analysts, SOC/Incident Response and offensive security/pentesters to operationalize intelligence, expand high-priority investigations and ensure exploited attack paths and high-risk behaviors are visible and monitored going forward.
• Maintain structured documentation of hunt hypotheses, methods, data sources, findings and outcomes; develop and maintain hunt playbooks and reusable queries; and serve as a technical mentor and escalation point for other hunters and analysts.

Qualifications

• Education Required: Bachelor's degree in Cybersecurity, Computer Science
• Education Preferred: Master's degree in Cybersecurity, Computer Science
• Experience Required: 6+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.
• Experience Preferred: 8+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.
• Licenses/Certifications Preferred: GCDA, GCIH, SC-200

Technical Skills and Abilities

• Advanced experience leading multi-source threat hunts across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud, email, DNS and web proxy data.
• Strong proficiency with SIEM / log query languages (e.g., KQL, S1QL) and building complex, ATT&CK-aligned hunting queries and analytics.
• Deep understanding of attacker TTPs and the MITRE ATT&CK framework, especially around credential theft, persistence, lateral movement, command and control, and data exfiltration.
• Proven ability to establish and refine behavioral baselines for users, systems and applications, and to use those baselines to distinguish benign anomalies from meaningful indicators of compromise.
• Experience designing, testing and tuning detections and analytics derived from hunt results, including evaluating false-positive/false-negative trade-offs.
• Strong collaboration skills working with CTI, SOC/Incident Response, penetration testers and detection engineers to operationalize intelligence, expand investigations and validate coverage of attack paths.
• Excellent documentation and communication skills, including producing structured hunt reports, maintaining playbooks and reusable queries, and briefing security leadership on findings and coverage.
• Ability to act as a technical mentor and escalation point for other hunters and analysts, reviewing their hunts and improving analytical rigor and consistency.

Additional Requirements

Language Requirements:Strong written and verbal communication skills in English are required.

Physical Demands:Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.May occasionally be required to support high-priority investig