Hypothesis-Driven Threat Hunter: Uncover Adversaries

Booz Allen Hamilton; McLean (VA); Vor Ort; USD 69.000 - 158.000; Vollzeit

Benefits dieser Stelle

Health benefits

Paid time off

Retirement plan

Zusammenfassung

Booz Allen Hamilton seeks a Cyber Threat Hunter to develop and execute hypothesis-driven hunts uncovering sophisticated adversary activity that may evade signals. You will combine threat intelligence with MITRE ATT&CK-driven analytics across endpoint, network, cloud, and identity telemetry to uncover evidence of malicious behavior.

You will work with incident responders, forensic investigators, threat intel analysts, and other security specialists to test hypotheses, document findings, and

Qualifikationen

• 3+ years of experience in threat hunting, incident response, digital forensics, detection engineering, or advanced security analysis.
• Experience conducting proactive threat hunts across multiple EDR/XDR and SIEM platforms.
• Knowledge of MITRE ATT&CK and translating adversary techniques into hunt hypotheses.
• Knowledge of endpoint telemetry (processes, execution, persistence, artifacts) and network telemetry (DNS, HTTP/S, proxies).
• Ability to correlate activity across endpoint, network, identity, cloud, and data sources to reconstruct attacker behavior.
• HS diploma or GED required.

Aufgaben

• Develop and execute proactive threat hunts based on adversary behavior, threat intel, incidents, and visibility gaps.
• Translate threat intelligence and attacker techniques into actionable hunt hypotheses and telemetry requirements.
• Map attacker tactics and techniques to hunt hypotheses using MITRE ATT&CK.
• Pivot across endpoint, network, identity, cloud, and data sources to reconstruct attacker behavior.
• Develop and maintain reusable hunt methodologies, queries, and playbooks.
• Escalate validated findings into the incident response process when evidence indicates compromise.

Kenntnisse

Threat hunting

Incident response

Digital forensics

Data analysis

MITRE ATT&CK knowledge

Telemetry correlation

Investigative reasoning

Communication

Ausbildung

HS diploma or GED

Tools

SentinelOne

CrowdStrike Falcon

Palo Alto Cortex XDR

Microsoft Defender for Endpoint

KQL

Jobbeschreibung

Booz Allen Hamilton seeks a Cyber Threat Hunter to develop and execute hypothesis-driven hunts uncovering sophisticated adversary activity that may evade signals. You will combine threat intelligence with MITRE ATT&CK-driven analytics across endpoint, network, cloud, and identity telemetry to uncover evidence of malicious behavior.

You will work with incident responders, forensic investigators, threat intel analysts, and other security specialists to test hypotheses, document findings, and