Threat Hunt Senior Associate

Kforce Inc; Tampa (FL); On-site; USD 110,000 - 140,000; Full time

Job summary

Kforce Inc. in Tampa, FL is seeking a Threat Hunt Senior Associate to conduct hypothesis-driven hunts across endpoints, identity, cloud, and network environments, aligning with MITRE ATT&CK techniques.

You will analyze telemetry from EDR/XDR, SIEM, and cloud sources, build investigations, tune detections with Sigma/YARA, and collaborate with Red/Purple teams to validate coverage and improve containment and response. Strong documentation and communication skills are essential.

Qualifications

• 3+ years in Threat Hunting or related cybersecurity roles.
• Experience with hypothesis-based threat hunts and MITRE ATT&CK.
• Experience with SIEM/EDR platforms and detections development.

Responsibilities

• Conduct hypothesis-driven threat hunts across endpoints, identity, cloud, and network.
• Analyze EDR/XDR, SIEM, identity, cloud, and Kubernetes telemetry to detect anomalies.
• Investigate credential abuse, persistence, lateral movement, and C2 activity.
• Build investigation timelines, scope, root-cause, and containment actions.
• Document hypotheses, evidence, findings, and follow-up actions for repeatable investigations.
• Convert hunt findings into improved detections, SIEM rules, and telemetry enhancements.
• Develop/tune detections with Sigma, YARA, SIEM rules, or EDR controls.
• Partner with Red/Purple Teams to validate coverage via adversary simulations.
• Support security incidents with rapid scoping, searches, containment, and post-incident improvements.
• Collaborate with automation teams to streamline enrichment and triage processes.

Skills

Threat Hunting experience

Hypothesis-based hunting

MITRE ATT&CK

Telemetry analysis

KQL / Splunk / Elastic

SIEM/EDR/XDR

Credential attacks & LOLBins

Cloud/Container security

Sigma / YARA / SIEM rules

Documentation & communication

Job description

Responsibilities

Kforce has a client in need of a Threat Hunt Senior Associate in Tampa, FL. Responsibilities:

• Conduct hypothesis-driven threat hunts aligned with MITRE ATT&CK techniques across endpoint, identity, cloud, and network environments
• Analyze EDR/XDR, SIEM, identity, cloud, and Kubernetes telemetry to identify and investigate suspicious activity
• Investigate credential abuse, persistence, lateral movement, defense evasion, command-and-control activity, and cloud-based threats
• Build investigation timelines, determine scope and impact, perform root-cause analysis, and recommend containment actions
• Document hunt hypotheses, queries, evidence, findings, confidence levels, and follow-up activities to ensure repeatable investigations
• Convert hunt findings into improved detections, SIEM rules, monitoring controls, and telemetry enhancements
• Develop and tune detection logic using technologies such as Sigma, YARA, SIEM analytics, and EDR controls
• Partner with Red/Purple Teams to validate detection coverage through adversary simulations and controlled testing
• Support security incidents with rapid scoping, related-activity searches, containment analysis, and post-incident improvements
• Collaborate with automation teams to streamline recurring enrichment, investigation, and triage processes

Requirements

• 3+ years of experience in Threat Hunting, Detection Engineering, Incident Response, SOC investigations, or similar cybersecurity functions
• Hands-on experience conducting and documenting hypothesis-based threat hunts
• Strong understanding of MITRE ATT&CK and common adversary tactics, techniques, and procedures
• Experience analyzing security telemetry across endpoint, identity, network, and cloud environments
• Proficiency with at least one security query language or platform, such as KQL, Splunk SPL, Elastic/Kibana, or Google SecOps/Chronicle
• Experience with SIEM and EDR/XDR platforms and security detection development
• Knowledge of credential attacks, PowerShell/LOLBins, persistence techniques, command-and-control activity, and network anomalies
• Familiarity with cloud and container security, including suspicious API activity, identity abuse, and Kubernetes threats
• Experience developing or tuning detections using Sigma, YARA, SIEM rules, or EDR-based controls
• Strong investigative, analytical, documentation, and communication skills

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.