Threat Hunter (Mid-Level Cyber Defense)

Phase2 Technology; Bethesda (MD); On-site; USD 62,000 - 141,000; Full time

Job summary

Booz Allen Hamilton is seeking a Cyber Threat Hunter (Mid) to advance threat hunting across enterprise networks, leveraging MITRE ATT&CK and threat intelligence. You will develop analytics, refine detections, and collaborate with SOC, IR, and CTI teams to improve visibility and responses.

The role emphasizes hypothesis-driven hunts, deep-dive log and endpoint analysis, and production of actionable hunt reports for leadership and mission stakeholders.

Qualifications

• 2+ years analyzing adversary behaviors and conducting structured, hypothesis-driven hunts.
• Experience with MITRE ATT&CK and Splunk PEAK.
• Experience leveraging threat intelligence to develop hunt hypotheses.
• Experience performing advanced analytics, log analysis, and forensic triage.
• Experience maintaining documentation, SOPs, and repeatable workflows.

Responsibilities

• Proactively identify malicious activity and strengthen the organization’s defensive posture.
• Conduct hypothesis-driven hunts across enterprise networks using threat intel and behavioral analytics.
• Develop and refine analytics, detection logic, and visibility gaps.
• Document repeatable workflows and produce high-quality hunt reports.
• Brief leadership and stakeholders on emerging threats, outcomes, and recommended improvements.
• Collaborate with SOC, IR, CTI, and platform engineering to operationalize intelligence.

Skills

Threat hunting

MITRE ATT&CK

Threat intelligence

Log analysis

Documentation

Clearance readiness

SPL queries

Education

Bachelor's degree

Tools

Splunk Enterprise

SPL

Job description

Booz Allen Hamilton is seeking a Cyber Threat Hunter (Mid) to advance threat hunting across enterprise networks, leveraging MITRE ATT&CK and threat intelligence. You will develop analytics, refine detections, and collaborate with SOC, IR, and CTI teams to improve visibility and responses.

The role emphasizes hypothesis-driven hunts, deep-dive log and endpoint analysis, and production of actionable hunt reports for leadership and mission stakeholders.