Security Operations & Threat Hunting Analyst

D&H Distributing; Harrisburg (Dauphin County); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Employee Ownership

401k

Paid Time Off

Medical, Prescription, Dental and Vis​

Vision benefits

Gym Reimbursement

Work from Home Reimbursement

Employee Purchase Program

Tuition Assistance

Job summary

D&H Distributing, a long‑standing employee‑owned technology distributor, is seeking a Security Operations and Threat Hunting Analyst to monitor, detect, and respond to cybersecurity threats across our environment. The role emphasizes proactive threat hunting, incident response leadership, and improving detection capabilities.

You will work with SIEM, EDR/XDR, email security, and cloud security tools to investigate threats, document findings, and strengthen the organization’s security

Qualifications

• Associate degree required in cybersecurity or related field, or equivalent work experience.
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science preferred.
• 5–10 years in cybersecurity, security operations, or related roles preferred.
• Experience with SIEM/EDR/XDR, vulnerability management, and case management preferred.
• Certifications such as Security+, CySA+, GCIA, GCFA or CISSP are a plus.

Responsibilities

• Monitor security alerts, logs, and telemetry to identify suspicious activity.
• Investigate incidents to determine scope, root cause, and response actions.
• Lead proactive threat hunting using telemetry, intelligence, and MITRE ATT&CK knowledge.
• Develop detection logic, rules, dashboards, and playbooks to improve monitoring.
• Coordinate with teams to contain, remediate, and validate resolutions.
• Support incident response with containment, eradication, and recovery activities.
• Document investigations, timelines, evidence, and recommendations clearly.
• Stay current on threats, vulnerabilities, and industry trends.

Skills

Strong communication

Analytical thinking

Threat hunting

Incident response

Security monitoring

Education

Associate degree in Cybersecurity

Bachelor’s degree in Cybersecurity

Tools

SIEM

EDR/XDR

Vulnerability management

Threat intelligence

Job description

Security Operations and Threat Hunting Analyst

D&H is growing!

Join 100+ year old Employee-Owned technology distributor, offering end-to-end solutions for today's resellers, retailers, and the clients they serve across the SMB and Consumer markets.

• We are empowered by our employee Co-Owners who provide the industry’s best service, and we promote a collaborative culture.
• We offer an Employee Stock Ownership Plan, 401k, Paid Time Off, Medical, Prescription, Dental and Vision benefits as well as Gym Reimbursement, Work from Home Reimbursement, Employee Purchase Program, Tuition Assistance and much more!
• As a D&H Co-Owner you receive numerous discounts on services.
• We feel strongly about giving back to the community and promoting sustainable, eco-friendly business practices.

Summary

The Security Operations and Threat Hunting Analyst is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across D&H Distributing’s environment. This role focuses on identifying suspicious activity, analyzing security events, supporting incident response, and proactively hunting for threats that may evade automated controls. The analyst helps reduce risk by improving detection capabilities, documenting findings, supporting containment and remediation efforts, and strengthening the organization’s overall security posture.

Essential Duties And Responsibilities

• Monitor security alerts, logs, endpoint activity, network events, and other telemetry sources to identify suspicious or malicious activity
• Investigate security events and incidents to determine scope, severity, root cause, affected systems, and appropriate response actions
• Perform proactive threat hunting using security telemetry, threat intelligence, behavioral analysis, and knowledge of adversary tactics, techniques, and procedures
• Develop, test, and refine hunting hypotheses to identify hidden threats, anomalous behavior, lateral movement, privilege misuse, persistence mechanisms, and other indicators of compromise
• Lead incident response activities, including triage, containment, eradication, recovery, evidence gathering, and post-incident analysis
• Use SIEM, EDR/XDR, email security, identity, cloud, vulnerability, and network security tools to correlate events and investigate potential threats
• Analyze attacker behaviors, indicators of compromise, malware activity, phishing attempts, suspicious authentication patterns, endpoint activity, and network traffic
• Create and improve detection logic, alerting rules, use cases, dashboards, playbooks, and investigative workflows to enhance monitoring and response capabilities
• Leverage threat intelligence and frameworks such as MITRE ATT&CK, NIST, CIS, and related security guidance to inform investigations, threat hunts, and detection improvements
• Document investigations, findings, timelines, evidence, response actions, and recommendations in a clear and complete manner
• Coordinate with infrastructure, application, endpoint, cloud, and business teams to contain, remediate, and validate resolution of identified security issues
• Identify opportunities to improve security visibility, reduce false positives, strengthen response procedures, and enhance overall SOC effectiveness
• Stay current on emerging threats, vulnerabilities, attack techniques, security technologies, and industry trends relevant to detection and response
• Effectively deal with rapid change in a positive manner
• Participate in all company/location driven communication efforts, including huddles, department meetings, and other related efforts
• Maintain a positive and professional working relationship with peers, management, support resources, and the community with a constant commitment to teamwork and exemplary customer service to present a professional image of D&H Distributing
• Perform all other duties as assigned by management in a professional and efficient manner

Additional Duties

• Ability to communicate security risks, investigation results, and technical findings clearly to technical and non-technical audiences
• Ability to manage multiple investigations, alerts, threat hunting activities, and competing priorities with appropriate urgency
• Strong analytical thinking, time management, attention to detail, documentation, and communication skills

Qualifications

• Exceptional verbal and written communication skills
• Strong analytical, investigative, and problem-solving skills with the ability to evaluate complex technical information
• Ability to communicate complex cybersecurity issues in business terms at any level within the organization
• Ability to respond to security incidents, communicate critical risks, and discuss containment, remediation, and resolution actions with management
• Highly self-motivated with a proactive mindset and curiosity for identifying hidden threats
• Ability to prioritize and execute tasks in a high-pressure environment and make sound decisions during security events with appropriate guidance and supervision
• Working knowledge of security monitoring, incident response, threat hunting, threat intelligence, network security, endpoint security, identity security, and common attack techniques

EDUCATION And/or EXPERIENCE

• Associate degree in Cybersecurity, Information Security, Computer Science, or a related area of study required, or equivalent years of related work experience
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related area of study preferred
• 5-10 years of experience in cybersecurity, security operations, incident response, threat detection, or related technical security functions preferred
• Experience using SIEM, EDR/XDR, email security, vulnerability management, threat intelligence, case management, or other security operations tools preferred
• Experience investigating phishing, malware, suspicious authentication activity, endpoint alerts, network anomalies, data exfiltration indicators, or other security events preferred
• Industry certifications such as Security+, CySA+, GCIH, GCIA, GCFA, GNFA, GCTI, CEH, CISSP, or similar preferred
• Scripting or automation experience in PowerShell, Python, Bash, or similar languages preferred
• Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and common security operations processes preferred