Threat Hunt Senior Associate (Cybersecurity)

Location: Tampa, FL; hybrid schedule with 3 days onsite

Company

hirify.global provides professional technology services and is hiring for a cybersecurity threat-hunting role.

What you will do

• Conduct structured, hypothesis-driven threat hunts across endpoint, identity, network, cloud, and container telemetry.
• Investigate attacker behavior involving credential theft, token misuse, OAuth abuse, PowerShell, WMI, persistence, command-and-control activity, cloud misuse, and Kubernetes environments.
• Correlate data from EDR/XDR, SIEM, cloud control plane, identity, container, and Kubernetes sources.
• Create or refine SIEM rules, Sigma, YARA, and EDR custom detections.
• Document observations, conclusions, confidence levels, and next steps in a repeatable format.
• Translate investigative outcomes into detection improvements, telemetry enhancements, response playbooks, and prioritized follow-up work; support incident response investigations when threat hunting can accelerate scoping, containment, or root-cause analysis.

Requirements

• 3–6 years of production experience in threat hunting, detection engineering, incident response, or SOC investigations.
• Experience conducting hypothesis-driven hunts and recording results in a repeatable, measurable format.
• Strong log analysis across endpoint, identity, network, and cloud data sources.
• Practical query and detection experience with one or more of KQL for Microsoft Sentinel or Defender, Splunk SPL, Elastic EQL/KQL/Lucene, or Chronicle/Google SecOps query language or an equivalent.
• Understanding of Windows fundamentals, including process relationships, services, scheduled tasks, and registry-based persistence.
• Working knowledge of Linux concepts, including systemd, cron, authentication logs, and process or network inspection.
• Familiarity with MITRE ATT&CK and the ability to map investigative evidence accurately to relevant techniques.
• Ability to produce clear investigative documentation, distinguish observations from conclusions, communicate confidence, and determine whether evidence supports escalation or requires additional investigation.
• Bachelor’s degree preferred.

Nice to have

• Experience with cloud and containerized environments, including AWS, Azure, GCP, Kubernetes, CI/CD telemetry, and cloud identity activity.
• Familiarity with NIST CSF or NIST 800-61 incident response concepts.
• Experience with SOAR platforms, enrichment, case management, automated triage, structured reporting, metrics, runbooks, and playbooks.
• Exposure to Red Team or Purple Team activities, atomic testing, or adversary emulation.
• Experience with Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Microsoft Sentinel, Splunk, Elastic, or Chronicle/Google SecOps.
• Knowledge of Azure or AWS logs, Entra ID/Azure AD, Okta, CloudTrail, activity logs, IAM telemetry, Kubernetes audit data, container runtime signals, registries, and CI/CD data.
• Scripting experience with Python, PowerShell, or Bash; familiarity with jq, osquery, or CyberChef.
• Relevant certifications such as GCFA, GCIH, GCIA, OSCP, or CISSP.
• Experience in financial services or fintech.

Culture & Benefits

• Hybrid work arrangement with 3 days onsite in Tampa, Florida.
• Contract-to-direct-hire employment structure.
• Hands-on work focused on improving threat detection, response procedures, telemetry coverage, and engineering priorities.

Hiring process

• Submit an application for Job ID 13213 through the provided application route.