Senior Cyber Security Analysts - Cyber Threat Hunting (CTH)

FIS Global•Jacksonville, FL

6d•Hybrid

About The Position

FIS Management Services, LLC is hiring Senior Cyber Security Analysts for its Cyber Threat Hunting (CTH) function in Jacksonville, Florida. The role drives proactive, hypothesis-based threat hunts across endpoint, network, identity, and cloud telemetry to uncover stealthy adversary activity and help reduce attack dwell time in the FIS environment. It involves independently conducting complex investigations with enterprise EDR and SIEM platforms, correlating evidence from multiple sources, and supporting rapid incident scoping, containment, and remediation for malware, credential compromise, and unauthorized access. The analyst documents hunt outcomes and conclusions, converts threat intelligence and adversary tactics, techniques, and procedures into behavioral analytics mapped to frameworks such as MITRE ATT&CK, and partners with Security Operations Center, Penetration Testing, and Detection Engineering stakeholders to turn successful hunts into durable detections and improved response playbooks. The role also automates and scales hunting workflows through scripting, enrichment, and data analysis. The position leads threat hunting in newly acquired or integrating M&A environments, assessing unfamiliar architectures, establishing baselines, identifying inherited risk and latent compromise, and hunting for pre- and post-acquisition adversary activity to inform integration and risk-reduction strategies. It provides technical direction, standards, and mentorship to support FIS’s internal Cyber Security function. Telecommuting and/or working from home may be permissible under company policies.

Requirements

Bachelor’s degree or foreign equivalent in Computer Engineering, Computer Science, Cybersecurity, or a related field.
Five years of experience in an information security or related role.
Experience performing threat hunting, cyber threat intelligence, and incident response in enterprise environments, including investigating malware, credential compromise, and unauthorized access.
Experience investigating endpoint security threats using enterprise EDR platforms, including CrowdStrike Falcon, with behavioral analysis of process activity, command-line execution, and persistence mechanisms.
Experience developing, tuning, and investigating security detections using SIEM platforms including Splunk, Azure Sentinel, and QRadar, analyzing authentication logs, endpoint telemetry, network events, and cloud audit logs.
Experience investigating malicious infrastructure threats using enterprise security and threat intelligence platforms, including Anomali.
Experience supporting cybersecurity incident response, including incident triage, scoping, containment, and remediation.
Experience using Python, PowerShell, and Bash for data analysis, alert enrichment, workflow automation, and investigative support.
Experience consuming and applying threat intelligence, including IOCs, adversary TTPs, and OSINT, and mapping activity to MITRE ATT&CK.
Ability to work from home or telecommute only as permitted by company policies.

Responsibilities

Conduct proactive, hypothesis-based threat hunts across endpoint, network, identity, and cloud telemetry.
Independently investigate complex threats using enterprise EDR and SIEM platforms, correlate evidence from multiple sources, and support incident scoping, containment, and remediation.
Investigate incidents involving malware, credential compromise, and unauthorized access.
Document threat-hunt outcomes and investigative conclusions.
Translate threat intelligence and adversary TTPs into high-fidelity behavioral analytics mapped to frameworks such as MITRE ATT&CK.
Partner with Security Operations Center, Penetration Testing Teams, and Detection Engineering stakeholders to operationalize hunts as durable detections and improved response playbooks.
Automate and scale hunting and investigative workflows using scripting, enrichment, and data analysis.
Lead threat hunts in newly acquired or integrating M&A environments, assessing architectures, establishing baselines, identifying inherited risk and latent compromise, and investigating pre- and post-acquisition adversary activity.
Provide technical direction, standards, and mentorship through threat-hunting expertise.
Investigate malicious infrastructure, including malicious domains, credential harvesting, and adversary-controlled infrastructure.
Support cybersecurity incident response, including triage, scoping, containment, and remediation.