Security Operations & Threat Hunting Analyst

D&H Distributing•Harrisburg, PA

About The Position

The Security Operations and Threat Hunting Analyst monitors, detects, investigates, and responds to cybersecurity threats across D&H Distributing’s environment. The role identifies suspicious activity, analyzes security events, supports incident response, and proactively hunts for threats that may evade automated controls. The analyst helps reduce risk by improving detection capabilities, documenting findings, supporting containment and remediation, and strengthening the organization’s security posture. The analyst works with security telemetry and tools to investigate events, lead incident response activities, develop and refine threat hunts, and improve detection logic and response workflows. The role also coordinates with technical and business teams to resolve security issues, communicates investigation results and risks to varied audiences, and stays current on emerging threats and security practices.

Requirements

Exceptional verbal and written communication skills.
Strong analytical, investigative, and problem-solving skills, with the ability to evaluate complex technical information.
Ability to explain complex cybersecurity issues in business terms to people at any organizational level.
Ability to respond to security incidents, communicate critical risks, and discuss containment, remediation, and resolution actions with management.
Highly self-motivated, proactive, and curious about identifying hidden threats.
Ability to prioritize and execute tasks in a high-pressure environment and make sound decisions during security events with appropriate guidance and supervision.
Working knowledge of security monitoring, incident response, threat hunting, threat intelligence, network security, endpoint security, identity security, and common attack techniques.
Associate degree in Cybersecurity, Information Security, Computer Science, or a related area of study, or equivalent years of related work experience.
Ability to adapt positively to rapid change.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related area of study.
5–10 years of experience in cybersecurity, security operations, incident response, threat detection, or related technical security functions.
Experience using SIEM, EDR/XDR, email security, vulnerability management, threat intelligence, case management, or other security operations tools.
Experience investigating phishing, malware, suspicious authentication activity, endpoint alerts, network anomalies, data exfiltration indicators, or other security events.
Industry certifications such as Security+, CySA+, GCIH, GCIA, GCFA, GNFA, GCTI, CEH, CISSP, or similar.
Scripting or automation experience in PowerShell, Python, Bash, or similar languages.
Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and common security operations processes.

Responsibilities

Monitor security alerts, logs, endpoint activity, network events, and other telemetry to identify suspicious or malicious activity.
Investigate security events and incidents to determine scope, severity, root cause, affected systems, and appropriate response actions.
Perform proactive threat hunting using security telemetry, threat intelligence, behavioral analysis, and knowledge of adversary tactics, techniques, and procedures.
Develop, test, and refine hunting hypotheses to identify hidden threats, anomalous behavior, lateral movement, privilege misuse, persistence mechanisms, and indicators of compromise.
Lead incident response activities, including triage, containment, eradication, recovery, evidence gathering, and post-incident analysis.
Use SIEM, EDR/XDR, email security, identity, cloud, vulnerability, and network security tools to correlate events and investigate potential threats.
Analyze attacker behaviors, indicators of compromise, malware activity, phishing attempts, suspicious authentication patterns, endpoint activity, and network traffic.
Create and improve detection logic, alerting rules, use cases, dashboards, playbooks, and investigative workflows.
Use threat intelligence and frameworks such as MITRE ATT&CK, NIST, and CIS to inform investigations, threat hunts, and detection improvements.
Document investigations, findings, timelines, evidence, response actions, and recommendations clearly and completely.
Coordinate with infrastructure, application, endpoint, cloud, and business teams to contain and remediate security issues and validate their resolution.
Identify opportunities to improve security visibility, reduce false positives, strengthen response procedures, and enhance SOC effectiveness.
Stay current on emerging threats, vulnerabilities, attack techniques, security technologies, and relevant industry trends.
Participate in company- and location-driven communication efforts, including huddles and department meetings.
Maintain professional working relationships and contribute to teamwork and customer service.
Perform other duties assigned by management.
Communicate security risks, investigation results, and technical findings clearly to technical and non-technical audiences.
Manage multiple investigations, alerts, threat-hunting activities, and competing priorities with appropriate urgency.