Threat Hunting Analyst: Proactive Defender in SOC & IR

FirstEnergy; Akron (OH); On-site; USD 95,000 - 130,000; Full time

Benefits offered by this job

Competitive pay

401(k) with matching

Tuition reimbursement

Job summary

FirstEnergy, headquartered in Akron, Ohio, is seeking an experienced Threat Hunter to proactively identify vulnerabilities and strengthen security operations. You will collaborate with SOCs, analyze TTPs, and produce detailed reports for stakeholders while researching IOCs and advisories to reduce noise and improve defenses.

The role requires strong programming knowledge, security expertise, and the ability to work independently within a dynamic team.

Qualifications

• Bachelor's degree in computer science, Information Security, or similar discipline is required with 1 to 3 years of experience.
• Industry standard certifications will be considered such as OSCP, GIAC (GCTI, GCIH, GREM, GCFA), CISSP and HTB CPTS.
• A bachelor's degree in another field with 4 years relevant industry experience in cyber/information security will be considered.
• In lieu of a degree, 3 years of related experience is required.
• Related experience includes SOC experience, IT Security in detection, triage, investigation, and remediation of security incidents within a network.
• Understanding of adversarial techniques (MITRE ATT&CK).
• Understanding programming/scripting code (Python, PowerShell, Bash, C#).
• Understanding of Linux and Windows operating systems.
• Strong communication skills, both verbal and written.
• Creative problem solving and solutioning.
• Ability to work independently and in a team.
• Ability to protect highly confidential information.
• Ability to learn independently and from others.
• Ability to find answers using open-sourced information.
• Understanding of networking concepts and technologies.
• Must be organized with changing priorities.
• Must be able to work independently with minimal supervision.

Responsibilities

• Proactively search for and identify vulnerabilities in the organization’s security systems.
• Collaborate with the SOCs to convert intelligence into actionable defensive capabilities.
• Evaluate intelligence sources and feeds for relevance, accuracy, timeliness, and operational value to reduce noise.
• Analyze threat actors' TTPs and provide detailed technical reports for stakeholders.
• Analyze threat reporting from OSINT, ISACs, and trusted industry partners.
• Research and enrich IOCs including domains, IPs, URLs, hashes, certificates.
• Monitor geopolitical events, vulnerabilities, and nation-state campaigns for impact
• Act as a cybersecurity SME to support the SOC and advise on security solutions
• Maintain expertise in log analysis, malware reverse engineering, memory forensics, telemetry, and analytics
• Assist with incident response for operational and cybersecurity issues
• Identify process improvements to advance security operations
• Improve detections in SIEM, EDR, and SOAR by tuning content and creating new rules
• Re-evaluate controls and advise on best practices
• Research new capabilities from open and closed sources to enhance SOC ecosystem
• Collaborate with cross-functional teams on cybersecurity projects
• Educate stakeholders on security risks and infrastructure changes
• Champion FE’s Core Values through leadership and example
• Assist with metrics, reporting, and SOC communications
• Share information with other FirstEnergy security teams

Skills

Python

PowerShell

Bash

C#

MITRE ATT&CK

Linux

Windows

Communication

Problem solving

Team collaboration

Education

Bachelor's degree in computer science or Information Security

OSCP

GIAC (GCTI, GCIH, GREM, GCFA)

CISSP

HTB CPTS

4+ years cyber/security experience

Tools

SIEM

EDR

SOAR

Job description

FirstEnergy, headquartered in Akron, Ohio, is seeking an experienced Threat Hunter to proactively identify vulnerabilities and strengthen security operations. You will collaborate with SOCs, analyze TTPs, and produce detailed reports for stakeholders while researching IOCs and advisories to reduce noise and improve defenses.

The role requires strong programming knowledge, security expertise, and the ability to work independently within a dynamic team.