Cyber Threat Hunter

Location: Fully remote in the United States; candidates near hirify.global offices may choose hybrid work with office attendance on Tuesdays and Wednesdays. Authorization to work in the United States is required.

Salary: $116,000–$125,000 annually, adjusted based on location, experience, qualifications, impact, and market data.

Company

hirify.global is a self-sustaining nonprofit supporting educational and career opportunities through programs including the Digital SAT and AP.

What you will do

• Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry, documenting findings and control or detection improvements.
• Build, tune, and maintain detections for IAM misuse, persistence, privilege escalation, data access, and exfiltration; reduce alert noise through baselining and enrichment.
• Support incident investigation and containment through triage, log analysis, impact scoping, root-cause analysis, after-action reporting, and playbook development.
• Participate in tabletop, fire drill, and purple team exercises to validate detection effectiveness, readiness, and remediation priorities.
• Partner with engineering, architecture, product security, GRC, product, offensive testing, and development teams to improve logging, telemetry, configurations, and controls.
• Develop lightweight automation and scripts, use LLMs and AI tools with output validation, maintain documentation, and share threat insights.

Requirements

• 1–3 years of enterprise cyber defense experience in threat hunting, detection engineering, SOC analysis, or incident response; recent graduates with at least one year of relevant hands-on experience are encouraged to apply.
• Clear understanding of proactive, hypothesis-driven threat hunting and its difference from incident response.
• Strong foundations in endpoint and operating system behavior, including process trees, parent and child processes, and anomalous activity.
• Foundational to moderate AWS security experience, including CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch Logs, and GuardDuty.
• Hands-on experience writing queries and working with EDR, SIEM, and authentication logs, including tuning detections to improve signal-to-noise.
• Experience supporting incident response through triage, log analysis, scoping, and documentation.
• Strong written and verbal communication skills, including explaining findings to technical and non-technical stakeholders.
• Experience collaborating with engineering, architecture, and development teams.
• Eagerness to learn quickly, ask questions, and bring a fresh perspective; clear communication, a learner’s mindset, commitment to growth, data-informed problem solving, and an empathetic collaborative approach.

Nice to have

• Certifications such as GCIA, GCIH, GNFA, AWS Security Specialty, or Security+.
• Familiarity with containers, Kubernetes, serverless platforms, CI/CD pipelines, and identity-based attacks in cloud environments.
• Strong automation and scripting skills in Python, PowerShell, or Bash.
• Familiarity with LLMs and AI tooling for security workflow automation.
• Exposure to purple team activities, detection validation, and MITRE ATT&CK mapping.
• Exposure to log forensics, timeline analysis, evidence handling, or investigative methods.
• Experience in an MDR, SOC, or GRC role with incident response exposure.
• Experience with Sumo Logic.

Culture & Benefits

• Mission-driven nonprofit work supporting educational and career opportunities.
• Fully remote work in the United States, with an optional hybrid arrangement for candidates near hirify.global offices.
• Collaborative experimentation, shared problem solving, and opportunities to build capabilities, automate threat hunts, and create internal tools.
• A balanced on-call model and managed detection and response partnership designed to reduce alert fatigue.
• Compensation conversations are transparent, with competitive salary adjustments based on location and market data.

Hiring process

• Applications are reviewed immediately and remain open for at least five business days or until the position is filled.
• The process generally includes application review, recruiter phone or video screening, hiring manager interview, a performance exercise such as live coding, panel interview, leadership conversation, and reference checks.