Cyber Threat Hunting Analyst

Sysco

1d•Hybrid

About The Position

The Cyber Threat Hunting Analyst serves as a technical lead for proactive threat hunting, identifying advanced threats that evade traditional security controls. The analyst designs and drives hunt campaigns across endpoint, identity, cloud, email, and DNS/proxy data, and turns hunt results into durable detection and monitoring improvements. The role also guides and mentors other hunters and analysts and represents threat hunting in cross-team detection and response strategy discussions. It is a hands-on position for an analyst with SOC/incident response or detection experience who prefers investigative work over responding solely to alerts. The position is hybrid and based in Sysco’s Houston office. Travel is minimal. The analyst may occasionally support high-priority investigations or coordinated hunts outside standard business hours. Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of the job.

Requirements

Bachelor’s degree in Cybersecurity or Computer Science.
At least 6 years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.
Advanced experience leading multi-source threat hunts across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud, email, DNS, and web proxy data.
Strong proficiency with SIEM/log query languages such as KQL or S1QL and building complex, MITRE ATT&CK-aligned hunting queries and analytics.
Deep understanding of attacker TTPs and the MITRE ATT&CK framework, especially credential theft, persistence, lateral movement, command and control, and data exfiltration.
Ability to establish and refine behavioral baselines and use them to distinguish benign anomalies from meaningful indicators of compromise.
Experience designing, testing, and tuning detections and analytics derived from hunt results, including evaluating false-positive and false-negative trade-offs.
Strong collaboration skills with CTI, SOC/Incident Response, penetration testers, and detection engineers.
Excellent written and verbal communication in English, including the ability to produce structured hunt reports, maintain playbooks and reusable queries, and brief security leadership.
Ability to mentor and serve as an escalation point for hunters and analysts, review their hunts, and improve analytical rigor and consistency.
Applicants must be currently authorized to work in the United States.

Nice To Haves

Master’s degree in Cybersecurity or Computer Science.
At least 8 years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.
Preferred certifications: GCDA, GCIH, or SC-200.

Responsibilities

Lead complex, proactive threat-hunting investigations across EDR, SIEM/log analytics, identity systems (AD/Azure AD/IdP), cloud platforms, email, DNS, and web proxy data to uncover previously undetected threats, attacker techniques, and misconfigurations.
Own the threat-hunting roadmap and backlog; define and prioritize hunt topics; and maintain playbooks and use cases informed by threat intelligence, recent campaigns, penetration-test findings, and knowledge of the environment.
Establish and refine behavioral baselines for key users, systems, and applications to distinguish benign anomalies from meaningful indicators of compromise or abuse.
Translate successful hunts and identified patterns into detection content, including rules, analytics, scheduled searches, and watchlists; lead testing and tuning with Detection Engineering before production rollout.
Collaborate with CTI analysts, SOC/Incident Response, and offensive security or penetration testers to operationalize intelligence, expand priority investigations, and ensure exploited attack paths and high-risk behaviors are monitored.
Document hunt hypotheses, methods, data sources, findings, and outcomes; develop and maintain hunt playbooks and reusable queries; mentor other hunters and analysts; and serve as an escalation point.
Select hypotheses, data sources, queries, and investigative approaches for assigned hunts; determine which anomalies warrant further investigation; prioritize concurrent hunt work; and document findings and follow-up recommendations.
Propose new or modified detections and analytics based on hunt results, subject to review or approval for production deployment or significant changes to broader detection strategy.