Threat Hunter II: Proactive Cyber Defense (TS/SCI | Polygraph)

Invictus International; Colorado Springs (CO); On-site; USD 120,000 - 170,000; Full time

Job summary

Invictus International in Colorado Springs seeks a Threat Hunter to independently conduct hypothesis-driven hunts across enterprise telemetry and identify malicious activity not detected by automated controls. You will proactively analyze security telemetry to uncover indicators of compromise and adversary activity that evade thresholds.

The role requires correlating data from network, endpoint, identity, SIEM, threat intelligence, and other sources; documenting findings; and supporting incident

Qualifications

• Hands-on experience with threat hunting, security analysis, incident investigation, threat intelligence analysis, or comparable proactive cyber defense work.

Responsibilities

• Independently conduct hypothesis-driven threat hunts across available enterprise telemetry to identify malicious or anomalous activity not detected by automated controls.
• Proactively analyze security telemetry to identify indicators of compromise, anomalous behavior, and adversary activity that has not met an incident threshold or has evaded automated security controls.
• Assess and correlate data from multiple sources, including network, endpoint, identity, SIEM, threat intelligence, vulnerability, and other available security data.
• Document hunt activity, findings, evidence, and recommended follow-on actions in authorized systems and initiate or support incident-response processes when malicious activity is identified.
• Provide relevant findings and trends for SOC operational reporting, significant-activity reporting, and defensive awareness.
• Develop hunt hypotheses based on threat intelligence, adversary TTPs, environmental observations, emerging threats, and known detection gaps.
• Use MITRE ATT&CK and other threat-informed methodologies to characterize observed behavior and guide analytical pivots.
• Identify patterns, relationships, and potential adversary activity across users, hosts, network segments, and time periods.
• Recommend new or improved detections, data collection, enrichment, and defensive controls based on hunt outcomes.

Skills

Threat hunting

Security analysis

Incident investigation

Threat intelligence analysis

MITRE ATT&CK

Adversary TTPs

SIEM

Network telemetry

Endpoint telemetry

Certification (DoD 8570 IAM II/IAT II)

Education

Bachelor's degree in a technical discipline

Tools

SIEM

Network-security monitoring

Endpoint telemetry

Job description

Invictus International in Colorado Springs seeks a Threat Hunter to independently conduct hypothesis-driven hunts across enterprise telemetry and identify malicious activity not detected by automated controls. You will proactively analyze security telemetry to uncover indicators of compromise and adversary activity that evade thresholds.

The role requires correlating data from network, endpoint, identity, SIEM, threat intelligence, and other sources; documenting findings; and supporting incident