OT Threat Hunt Analyst

Booz Allen Hamilton•Lakewood, CO

22h

About The Position

Join a high-impact, mission-driven team operating at the forefront of cyber defense for critical infrastructure. As a Threat Hunter, you will be part of a small, agile group entrusted with proactively identifying and disrupting advanced threats targeting some of the nation’s most essential systems. This role goes beyond traditional detection and response. You will lead and execute sophisticated threat hunting operations, transforming emerging intelligence into actionable hunt missions, engineering novel collection capabilities, and uncovering adversary activity that evades conventional security controls. Working at the intersection of cyber threat intelligence, detection engineering, and operational technology (OT), you will help defend complex, real-world environments where the stakes are tangible and immediate. You will collaborate closely with system owners, engineers, and OT subject matter experts to design and deploy innovative approaches to visibility and analysis, often in environments where telemetry is limited and adversaries are highly adaptive. Your work will directly support federal missions, contributing to the resilience and security of critical infrastructure sectors. This is a role for a technically deep, creatively minded operator who thrives in ambiguity, enjoys building new capabilities from the ground up, and is motivated by meaningful, national-level impact. Join us. The world can’t wait.

Requirements

10+ years of experience supporting cyber operations in incident response, threat hunting, detection engineering, offensive operations, or cybersecurity and information assurance
Experience conducting proactive, hypothesis-driven threat hunts in enterprise or industrial environments
Experience mapping activity to frameworks, such as MITRE ATT&CK
Experience with a query and analysis platform, such as SIEM or EDR, or log analytics tools
Experience analyzing endpoint, network, and log data to identify malicious or anomalous behavior
Knowledge of adversary tactics, techniques, and procedures (TTPs)
Ability to translate cyber threat intelligence into actionable hunt hypotheses, operational plans, and detection analytics
Ability to design, test, and iterate on data collection strategies in constrained or complex environments
Ability to clearly document findings and brief technical and non-technical audiences
Top Secret clearance
Bachelor's degree
GIAC, such as GCFA, GCIH, or GCIA, or CISSP Certification

Nice To Haves

Experience working with industrial control systems (ICS), SCADA environments, or other operational technology (OT) networks
Experience with the development of custom detection content, signatures, or behavioral analytics beyond out-of-the-box tooling
Experience with scripting or programming, such as Python or PowerShell, to automate analysis or build custom tooling
Experience with the U.S. Intelligence Community and using intelligence to support cyber defensive operations
Experience conducting threat hunting in cloud or hybrid environments, such as AWS, Azure, or containerized infrastructure
Experience with threat emulation or purple teaming
Knowledge of OT protocols, such as Modbus or DNP3, and visibility challenges unique to industrial environments
Knowledge of memory forensics, malware analysis, or reverse engineering
Possession of strong written and verbal communication skills

Responsibilities

Proactively identify and disrupt advanced threats targeting some of the nation’s most essential systems
Lead and execute sophisticated threat hunting operations
Transform emerging intelligence into actionable hunt missions
Engineer novel collection capabilities
Uncover adversary activity that evades conventional security controls
Help defend complex, real-world environments where the stakes are tangible and immediate
Collaborate closely with system owners, engineers, and OT subject matter experts to design and deploy innovative approaches to visibility and analysis
Directly support federal missions, contributing to the resilience and security of critical infrastructure sectors