Cyber Threat Hunter

College Board•Remote - Virginia, VA

5d•$116,000 - $125,000•Remote

About The Position

The Cyber Threat Hunter will help defend College Board’s cloud and enterprise environments, including the systems that support the Digital SAT, AP, and other high-stakes programs. The role operates in an AWS-heavy environment at national scale and focuses on proactive, hypothesis-driven threat hunting, investigation, and clear documentation to support exam integrity and student trust. This early-career position begins with learning the environment and tools, then progresses to conducting threat hunts alongside senior engineers, building and tuning detections, supporting incident investigations, and improving playbooks. The role also contributes to purple team exercises and automation that makes security workflows faster and more reliable. The Cyber Threat Hunter works with engineering, architecture, product security, GRC, and product teams to close visibility gaps and reduce risk. The position is fully remote; candidates who live near College Board offices may choose a hybrid arrangement, working in the office Tuesday and Wednesday. It is a full-time role.

Requirements

1 to 3 years of experience in cyber defense, such as threat hunting, detection engineering, SOC analysis, or incident response, in enterprise environments; recent graduates with at least one year of relevant hands-on experience are encouraged to apply.
Clear understanding of proactive, hypothesis-driven threat hunting and how it differs from incident response.
Strong foundations in endpoint and operating system behavior, including process trees, parent and child processes, and recognizing anomalous activity.
Foundational to moderate AWS cloud security experience, including cloud-native telemetry such as CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch logs, and GuardDuty.
Hands-on experience writing queries and working with security telemetry such as EDR, SIEM, and authentication logs, including tuning detections to improve signal-to-noise.
Experience supporting incident response, including triage, log analysis, scoping, and documentation.
Strong written and verbal communication skills, including clear investigation documentation and explaining findings to technical and non-technical stakeholders.
Collaborative approach and experience partnering across engineering, architecture, and development teams.
Eagerness to learn quickly, ask questions, and bring a fresh perspective to established processes.
Passion for expanding educational and career opportunities and mission-driven work.
Curiosity and enthusiasm for emerging technologies, willingness to experiment with and adopt AI-driven solutions, and comfort independently learning and applying new digital tools.
Clear and concise written and verbal communication skills.
Learner’s mindset and commitment to growth, including welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving.
Drive for impact and excellence, including solving complex problems, making data-informed decisions, prioritizing effectively, and continuous improvement.
Collaborative and empathetic approach, including working across differences, fostering trust, and contributing to shared success.
Authorization to work in the United States.

Nice To Haves

Relevant certifications, such as GCIA, GCIH, GNFA, AWS Security Specialty, or Security+.
Familiarity with modern cloud platforms and technologies such as containers, Kubernetes, serverless, and CI/CD pipelines, and with detecting identity-based attacks in cloud environments.
Strong automation and scripting skills, such as Python, PowerShell, or Bash, to streamline investigations, enrich alerts, and improve repeatability.
Familiarity with using LLMs and AI tools to automate security workflows.
Exposure to purple team or detection validation activities and mapping detections to MITRE ATT&CK.
Exposure to investigative and forensic methods, such as log forensics, timeline analysis, and evidence handling.
Experience in an MDR, SOC, or GRC role with incident response exposure.
Experience with Sumo Logic.

Responsibilities

Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry; document findings and recommend control or detection improvements.
Help build, tune, and maintain detections for high-risk behaviors, including IAM misuse, persistence, privilege escalation, and data access or exfiltration.
Reduce alert noise through structured tuning, baselining, and enrichment while preserving meaningful coverage.
Map detections and hunts to MITRE ATT&CK techniques to identify and address visibility gaps.
Support security incident investigation and containment through log analysis, impact scoping, and documentation.
Contribute to the development and refinement of incident response playbooks for common cloud and identity-based scenarios.
Prepare after-action reports identifying root causes, control gaps, and prioritized remediation steps.
Participate in tabletop and fire drill exercises to validate readiness and improve response coordination.
Participate in purple team exercises to validate detection effectiveness and prioritize remediation of identified gaps.
Work with offensive testing and engineering teams to translate findings into improved detections and hardened configurations.
Identify opportunities to strengthen logging, telemetry coverage, and control effectiveness across cloud and enterprise systems.
Develop lightweight automation and scripts to improve investigation speed, enrichment, and reporting consistency.
Use LLMs and AI tools to support enrichment, automation, and tool development, validating outputs before relying on them.
Maintain documentation for detection logic, hunt results, and response procedures.
Share threat insights and lessons learned with security and engineering communities through briefings or written updates.