SK Threat Hunter

Probity; McLean (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

Probity is seeking a Cyber Threat Hunter to proactively detect, investigate, and mitigate threats in a large enterprise. You will use hypothesis-based hunting (HMM-4) and the MITRE ATT&CK framework, collaborating with cross-functional teams to analyze logs, network data, and telemetry to identify anomalies and respond effectively.

Your role requires strong analytical and communication skills, 3+ years in cyber security, and certifications such as GCIH/CTIA.

Qualifications

• 3+ years in cyber security analyst or related role; 4-6 years preferred.
• Strong proficiency in hypothesis-based hunting (HMM-4) and MITRE ATT&CK.

Responsibilities

• Conduct proactive threat hunting using HMM-4 and MITRE ATT&CK.
• Develop hypotheses for targeted threat hunts from threat intel and data.
• Collaborate with teams to collect and analyze security event data.
• Identify IOCs and anomalies using cutting-edge tools.
• Analyze threats, assess impact, and recommend mitigations.
• Document investigations with root cause analysis and remediation plans.

Skills

Threat hunting

Analytical thinking

Communication

Threat modelling

Tools

SIEM platforms

EDR solutions

Cloud environments (AWS, Azure)

Network analysis tools

Job description

Reach out to our recruiting team for more information on our current openings or joining the Probity team.

PLEASE NOTE: This position requires an ACTIVE Top Secret/SCI Clearance with Polygraph. To be considered for this position, you MUST have an ACTIVE Clearance Level of Top Secret/SCI with Polygraph

Position Code: 26-SE1002-1

Responsibilities:

As a Cyber Threat Hunter, you will be responsible for proactively detecting, investigating, and mitigating cyber threats within our large enterprise environment. Your primary focus will be on hypothesis-based threat hunting utilizing the HMM-4 approach and leveraging the Mitre ATT&CK framework. You will collaborate closely with cross-functional teams, including endpoint, network, offensive, threat intelligence, cloud, and data science experts, to identify, analyze, and respond to emerging threats.

Key responsibilities include:

• Conduct proactive threat hunting using the HMM-4 approach and Mitre ATT&CK framework.
• Develop and refine hypotheses for targeted threat hunts based on threat intelligence, internal data, and analysis of attacker tactics, techniques, and procedures (TTPs).
• Collaborate with internal teams to collect and analyze security event data from various sources, such as logs, alerts, network traffic, and endpoint telemetry.
• Utilize cutting-edge tools and technologies to identify indicators of compromise (IOCs) and anomalies that may indicate potential threats.
• Perform in-depth analysis of identified threats, assess their impact, and recommend appropriate mitigation and response strategies.
• Document investigative objectives and progress throughout threat hunt. Produce detailed reports and provide clear and concise communication on findings, to include root cause analysis and recommendations for remediation and risk mitigation. Propose enhanced detections where possible defensive gaps are identified.
• Stay up to date with the latest cyber threats, attack techniques, and security technologies through continuous learning and knowledge sharing.

Requirements:

• Minimum of 3 years of experience as a cyber security analyst, incident responder, or other closely related cyber security discipline. 4-6 years of experience desired.
• Professional Experience: Minimum of 3 years of experience as a cyber security analyst, incident responder, or other closely related cyber security discipline. 4-6 years of experience desired
• Methodological Expertise: Strong proficiency in hypothesis-based hunting (HMM-4), the Mitre ATT&CK matrix, and mapping adversary TTPs to observed activities.
• Technical Toolset: Hands-on proficiency with SIEM platforms, EDR solutions, network traffic analysis tools, and a deep understanding of cloud environments (AWS, Azure, etc.).
• Analytical & Communication Skills: Exceptional problem-solving skills in high-pressure situations, with the ability to translate complex technical findings for both technical and non-technical audiences.
• Education & Certification: Relevant industry certifications (e.g., GCIH, CTIA, or CThH) and a solid foundation in network protocols and endpoint security.