Cyber Threat Hunter (Cybersecurity)

Location: Remote within the United States, with possible in-person work at a Booz Allen or customer facility. Listed locations include McLean, Virginia; Colorado Springs and Denver, Colorado; Los Angeles and Sacramento, California; Phoenix, Arizona; Portland, Oregon; Salt Lake City, Utah; San Diego and San Francisco, California; and Seattle, Washington.

Salary: $69,400–$158,000 annualized USD.

Company

hirify.global provides technology and cybersecurity services and supports government and enterprise customers.

What you will do

• Develop and execute proactive, hypothesis-driven and exploratory threat hunts based on adversary behavior, emerging threats, threat intelligence, incidents, and detection gaps.
• Translate threat intelligence, malware behavior, and attacker techniques into hunt hypotheses using the MITRE ATT&CK framework.
• Query, correlate, and pivot across large-scale endpoint, network, identity, cloud, and security telemetry using EDR, XDR, SIEM, and security analytics platforms.
• Establish baselines and identify anomalous behavior, unusual relationships, telemetry gaps, and patterns associated with sophisticated adversary activity.
• Develop reusable hunt methodologies, queries, playbooks, and analytical techniques.
• Reconstruct attacker activity using forensic evidence, escalate validated findings to incident response, and turn investigation lessons into improved hunts and detections.

Requirements

• 3+ years of experience in threat hunting, incident response, digital forensics, detection engineering, or advanced security analysis, including threat hunting responsibilities.
• Experience conducting proactive threat hunts and analyzing large volumes of security telemetry across multiple EDR/XDR and SIEM platforms.
• Experience with at least one major EDR/XDR technology, such as SentinelOne, CrowdStrike Falcon, Palo Alto Cortex XDR, or Microsoft Defender for Endpoint.
• Knowledge of MITRE ATT&CK and the ability to translate adversary techniques into hunt hypotheses and identify the telemetry required for investigation.
• Knowledge of endpoint telemetry, including processes, command-line execution, parent-child relationships, persistence, services, scheduled tasks, registry activity, file activity, and operating system artifacts.
• Knowledge of network telemetry, including DNS, HTTP/S, proxy, firewall, connection, and network data.
• Ability to correlate endpoint, network, identity, cloud, and other data sources; pursue incomplete or ambiguous evidence; and document hypotheses, methodology, findings, evidence, and conclusions.
• High school diploma or GED.

Nice to have

• Experience with digital forensics or incident response investigations involving ransomware, hands-on-keyboard intrusions, credential theft, lateral movement, persistence, command and control, data staging, or exfiltration.
• Experience with cyber threat intelligence and translating intelligence reporting into actionable hunts.
• Experience developing behavior-based detections from successful threat hunts.
• Experience with Microsoft Sentinel or comparable enterprise SIEM platforms and multiple query languages, including KQL and vendor-specific languages.
• Experience scripting or automating security analysis with Python, PowerShell, or similar technologies.
• Knowledge of identity and authentication telemetry, cloud telemetry, and attacker techniques affecting identity or cloud environments.
• Strong analytical, verbal, and written communication skills.
• Cybersecurity certifications such as GCFA, GNFA, GCIH, GCIA, GCTI, GDAT, or comparable certifications.

Culture & Benefits

• Full-time employment with health, life, disability, financial, and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, and dependent care support.
• Full-time and part-time employees working at least 20 hours per week regularly may participate in benefit programs; employees below that threshold receive only select offerings.
• Remote employees may occasionally be required to work in person at a Booz Allen or customer facility.
• Virtual employees are generally expected to keep cameras on during meetings.
• Identity verification using biometrics is required during hiring; candidates must be on camera during interviews and assessments.
• Use of AI tools during interviews is prohibited unless explicitly permitted.

Hiring process

• Complete the required identity verification process, including camera use and possible photograph capture.
• Do not use artificial intelligence or other response-assistance tools during interviews unless explicit permission is provided.