Senior Threat Hunter & Detection Engineer

Kforce Inc; Tampa (FL); On-site; USD 110,000 - 140,000; Full time

Job summary

Kforce Inc. in Tampa, FL is seeking a Threat Hunt Senior Associate to conduct hypothesis-driven hunts across endpoints, identity, cloud, and network environments, aligning with MITRE ATT&CK techniques.

You will analyze telemetry from EDR/XDR, SIEM, and cloud sources, build investigations, tune detections with Sigma/YARA, and collaborate with Red/Purple teams to validate coverage and improve containment and response. Strong documentation and communication skills are essential.

Qualifications

• 3+ years in Threat Hunting or related cybersecurity roles.
• Experience with hypothesis-based threat hunts and MITRE ATT&CK.
• Experience with SIEM/EDR platforms and detections development.

Responsibilities

• Conduct hypothesis-driven threat hunts across endpoints, identity, cloud, and network.
• Analyze EDR/XDR, SIEM, identity, cloud, and Kubernetes telemetry to detect anomalies.
• Investigate credential abuse, persistence, lateral movement, and C2 activity.
• Build investigation timelines, scope, root-cause, and containment actions.
• Document hypotheses, evidence, findings, and follow-up actions for repeatable investigations.
• Convert hunt findings into improved detections, SIEM rules, and telemetry enhancements.
• Develop/tune detections with Sigma, YARA, SIEM rules, or EDR controls.
• Partner with Red/Purple Teams to validate coverage via adversary simulations.
• Support security incidents with rapid scoping, searches, containment, and post-incident improvements.
• Collaborate with automation teams to streamline enrichment and triage processes.

Skills

Threat Hunting experience

Hypothesis-based hunting

MITRE ATT&CK

Telemetry analysis

KQL / Splunk / Elastic

SIEM/EDR/XDR

Credential attacks & LOLBins

Cloud/Container security

Sigma / YARA / SIEM rules

Documentation & communication

Job description

Kforce Inc. in Tampa, FL is seeking a Threat Hunt Senior Associate to conduct hypothesis-driven hunts across endpoints, identity, cloud, and network environments, aligning with MITRE ATT&CK techniques.

You will analyze telemetry from EDR/XDR, SIEM, and cloud sources, build investigations, tune detections with Sigma/YARA, and collaborate with Red/Purple teams to validate coverage and improve containment and response. Strong documentation and communication skills are essential.