Cybersecurity Operations Center Hunt Analyst

MANTECH; Chantilly (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

MANTECH seeks a motivated, career- and customer-oriented Cybersecurity Operations Center Hunt Analyst to join our team in Chantilly, VA. The role focuses on proactive threat hunting, incident triage, and documenting findings to support a secure customer environment.

The analyst will monitor Microsoft Sentinel and Splunk environments, write SPL/KQL queries, and participate in threat hunts and tabletop exercises to strengthen defense capabilities.

Qualifications

• Bachelor’s degree in a technical field or equivalent experience.
• 5+ years of related technical experience; or 7+ years with HS/GED.
• Experience with cybersecurity alert triage and initial investigations.
• Proficiency filtering, summarizing, and analyzing time-based security data.

Responsibilities

• Monitor, acknowledge, investigate, and triage incidents across SIEM environments.
• Write and refine SPL and KQL queries to hunt for threats.
• Support migration from Splunk to Microsoft Sentinel and maintain telemetry.
• Analyze telemetry through pipelines and identify missing or malformed data.
• Assist with detection engineering, validation, and documenting false positives/negatives.
• Participate in threat hunts, exercises, and AI-assisted tooling usage.
• Maintain baselines, policies, and playbooks.

Skills

Incident triage

SPL/KQL queries

Security analytics

Documentation

Communication

Education

Bachelor’s degree in Computer Science / IT / Cybersecurity

Alternate: HS diploma with 7+ years of experience

Tools

Microsoft Sentinel

Splunk Enterprise Security

Cribl Stream/Edge

SIEM platforms

Job description

MANTECH seeks a motivated, career and customer-oriented Cybersecurity Operations Center Hunt Analyst to join our team in Chantilly, VA.

The CSOC Hunt Analyst will leverage their strong technical background and knowledge to support the customer’s cyber defense operations, to include proactively discovering issues, monitoring and triaging security alerts, conducting initial investigations, documenting findings, escalating incidents, and maintaining situational awareness across the monitored environment.

Responsibilities Include But Are Not Limited To

• Monitoring, acknowledging, investigating, and triaging incidents and alerts across Microsoft Sentinel and Splunk Enterprise Security environments.
• Writing and modifying Search Processing Language (SPL) and Kusto Query Language (KQL) queries to hunt for suspicious activities, conduct investigations, and analyze time-based security data.
• Supporting legacy Splunk operations while assisting with the migration of use cases, detections, telemetry, dashboards, and workflows to Microsoft Sentinel.
• Analyzing security telemetry flows through pipeline platforms such as Cribl Stream or Cribl Edge into SIEM systems and identifying missing or malformed telemetry.
• Supporting detection engineering by testing correlation searches and analytic rules, validating expected results, and documenting false positives and false negatives.
• Participating in threat hunts, cyber exercises, tabletop events, and detection-validation activities while utilizing approved AI-assisted tools to enhance research and workflows.
• Maintaining system baselines and configuration management items, including security event monitoring policies, standard operating procedures, and playbooks.

Minimum Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, and 5+ years of related technical experience or High School/GED and 7+ years of related technical experience
• Experience performing cybersecurity alert triage, initial incident investigation, and writing/troubleshooting basic-to-intermediate SPL and KQL queries.
• Demonstrated experience filtering, summarizing, correlating, and analyzing time-based security data across endpoint, identity, network, and cloud audit logs.
• Understanding of telemetry pipelines, data onboarding, normalization, parsing, routing, enrichment, and field mapping concepts.
• Experience creating, maintaining, and communicating complex technical documentation, including standard operating procedures, investigation notes, and playbooks.
• Must meet applicable DoD 8140/8570 workforce requirements, including an active IAT Level II certification (e.g., Security+ CE, CySA+, GSEC, CCNA Security, or CASP+ CE).

Preferred Qualifications

• Demonstrated working knowledge of Microsoft Sentinel (incidents, analytics rules, workbooks, KQL) and Splunk Enterprise Security (notable events, SPL, dashboards).
• Experience supporting an operational transition or migration from Splunk to Microsoft Sentinel and working with Cribl Stream/Edge.
• Relevant technical certifications such as Microsoft SC-200, Splunk Core/Enterprise Security, Cribl certification, or advanced cyber certifications.
• Familiarity with MITRE ATT&CK, threat-informed defense, adversary emulation, automated workflows, and AI-enabled cybersecurity tooling.

Clearance Requirements

• An active TS/SCI with Polygraph is required

Physical Requirements

• Must be able to remain in a stationary position 50% of the time.
• Needs to occasionally move about inside the office to access file cabinets, office machinery, etc.
• Frequently communicates with co-workers, management, and customers, which may involve delivering presentations. Must be able to exchange accurate information in these situations.