Threat Hunter SKY001

Sabree Software Services, Inc.; McLean (VA); On-site; USD 110,000 - 170,000; Full time

Job summary

Sabree Software Services, Inc. is seeking a Cyber Threat Hunter to proactively detect, investigate, and mitigate threats within a large enterprise environment.

You will base hunts on the HMM-4 approach and use the MITRE ATT&CK framework to identify attacker techniques and improve defenses. Collaborating with cross-functional teams across endpoint, network, cloud, threat intelligence, and data science, you will collect and analyze security data, develop hypotheses, perform in-depth analysis, and

Responsibilities

• Conduct proactive threat hunting using the HMM-4 approach and MITRE ATT&CK framework.
• Develop hypotheses for targeted hunts from threat intel and internal data.
• Collaborate with teams to collect and analyze security event data from logs, traffic, and telemetry.
• Identify IOCs and anomalies with advanced tools and techniques.
• Analyze threats, assess impact, and recommend mitigations and response plans.
• Document objectives and progress; produce detailed reports with root-cause analysis.
• Share findings and improve detections to close defensive gaps.

Job description

As a Cyber Threat Hunter, you will be responsible for proactively detecting, investigating, and mitigating cyber threats within our large enterprise environment. Your primary focus will be on hypothesis-based threat hunting utilizing the HMM-4 approach and leveraging the Mitre ATT&CK framework. You will collaborate closely with cross-functional teams, including endpoint, network, offensive, threat intelligence, cloud, and data science experts, to identify, analyze, and respond to emerging threats. Key responsibilities include:

• Conduct proactive threat hunting using the HMM-4 approach and Mitre ATT&CK framework.
• Develop and refine hypotheses for targeted threat hunts based on threat intelligence, internal data, and analysis of attacker tactics, techniques, and procedures (TTPs).
• Collaborate with internal teams to collect and analyze security event data from various sources, such as logs, alerts, network traffic, and endpoint telemetry.
• Utilize cutting-edge tools and technologies to identify indicators of compromise (IOCs) and anomalies that may indicate potential threats.
• Perform in-depth analysis of identified threats, assess their impact, and recommend appropriate mitigation and response strategies.
• Document investigative objectives and progress throughout threat hunt. Produce detailed reports and provide clear and concise communication on findings, to include root cause analysis and recommendations for remediation and risk mitigation. Propose enhanced detections where possible defensive gaps are identified.
• Stay up to date with the latest cyber threats, attack techniques, and security technologies through continuous learning and knowledge sharing.