Cybersecurity Threat Hunter (Ohio)

Markesman Group•Whitehall, OH

About The Position

The Cybersecurity Threat Hunter proactively searches enterprise networks for sophisticated cyber threats that may be operating undetected. The role analyzes network, endpoint, log, and security telemetry; develops hunting leads from threat intelligence and enterprise activity; and investigates adversary behavior across the attack lifecycle using the MITRE ATT&CK framework. The position also develops hunting strategies, scripts, tools, and automation; supports incident response; identifies mitigations for vulnerabilities; and documents investigations in clear narratives.

Requirements

At least 5 years of technical experience in Threat Intelligence, Cybersecurity Incident Response, Penetration Testing, Reverse Engineering, or Digital Forensics.
At least 3 years analyzing attacker techniques across the attack lifecycle.
Knowledge of security challenges across multiple operating systems.
Ability to work with large data sets.
Experience with Splunk and scripting languages such as Python and/or PowerShell.
Ability to turn threat intelligence into actionable information.
Knowledge of the MITRE ATT&CK framework.
Ability to use technical data to document threat-hunting operations.
Current DoD Top Secret clearance.
Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission.

Responsibilities

Proactively search for sophisticated cyber threats operating undetected within enterprise networks.
Analyze raw network, endpoint, log, and security telemetry for unusual or malicious activity.
Develop threat-hunting leads using cyber threat intelligence and observed enterprise activity.
Analyze adversary tactics, techniques, and procedures across the attack lifecycle.
Use MITRE ATT&CK to investigate and characterize adversary behavior.
Identify Advanced Persistent Threats and other sophisticated malicious activity.
Develop and refine threat-hunting strategies and methodologies.
Translate cyber threat intelligence into actionable defensive information.
Build scripts, tools, and automation to improve threat-hunting capabilities.
Work closely with Incident Response and Threat Detection teams.
Identify mitigations for vulnerabilities uncovered during hunting operations.
Support incident response activities for critical cybersecurity incidents.
Document hunt operations and build clear investigative narratives from technical data.