Senior Cyber Security Analysts - Cyber Threat Hunting (CTH)

FIS•Jacksonville, FL

11d

About The Position

FIS Management Services, LLC is hiring Senior Cyber Security Analysts for its Cyber Threat Hunting (CTH) function in Jacksonville, Florida. The role drives proactive, hypothesis-based threat hunts across endpoint, network, identity, and cloud telemetry to uncover stealthy adversary activity and reduce attack dwell time in the FIS environment. Analysts independently conduct complex investigations using enterprise EDR and SIEM platforms, correlate evidence from multiple sources, and support rapid scoping, containment, and remediation of incidents such as malware, credential compromise, and unauthorized access. The role documents hunt results and investigative conclusions, translates threat intelligence and adversary tactics, techniques, and procedures into high-fidelity behavioral analytics mapped to frameworks such as MITRE ATT&CK, and partners with Security Operations Center, Penetration Testing, and Detection Engineering teams to turn successful hunts into durable detections and improved response playbooks. It also uses scripting, enrichment, and data analysis to automate and scale investigative workflows. The analyst leads threat hunting in newly acquired or integrating M&A environments, quickly assessing unfamiliar architectures, establishing baselines, identifying inherited risk and latent compromise, and hunting for pre- and post-acquisition adversary activity. The position provides technical direction, standards, and mentorship to support FIS’s internal Cyber Security function. Telecommuting and/or working from home may be permissible under company policies.

Requirements

Bachelor’s degree or foreign equivalent in Computer Engineering, Computer Science, Cybersecurity, or a related field.
Five years of experience in an information security or related role.
Experience performing threat hunting, cyber threat intelligence, and incident response activities in enterprise environments, including investigating malware, credential compromise, and unauthorized access.
Experience investigating endpoint-based security threats using enterprise EDR platforms, including CrowdStrike Falcon, with behavioral analysis of process activity, command-line execution, and persistence mechanisms.
Experience developing, tuning, and investigating detections using SIEM platforms, including Splunk, Azure Sentinel, and QRadar, for authentication logs, endpoint telemetry, network events, and cloud audit logs.
Experience investigating malicious infrastructure threats, including malicious domains, credential harvesting activity, and adversary-controlled infrastructure, using enterprise security and threat intelligence platforms, including Anomali.
Experience supporting cybersecurity incident response, including triage, scoping, containment, and remediation.
Experience using Python, PowerShell, and Bash for data analysis, alert enrichment, workflow automation, and investigative support.
Experience consuming and applying threat intelligence, including IOCs, adversary TTPs, and OSINT, and mapping activity to MITRE ATT&CK.

Responsibilities

Conduct proactive, hypothesis-based threat hunts across endpoint, network, identity, and cloud telemetry.
Independently investigate complex security incidents using enterprise EDR and SIEM platforms and correlate evidence from multiple sources.
Support incident scoping, containment, and remediation, including for malware, credential compromise, and unauthorized access.
Document hunt outcomes and investigative conclusions.
Translate threat intelligence and adversary TTPs into high-fidelity behavioral analytics mapped to frameworks such as MITRE ATT&CK.
Partner with the Security Operations Center, Penetration Testing Teams, and Detection Engineering stakeholders to operationalize successful hunts as durable detections and improved response playbooks.
Automate and scale hunting and investigative workflows using scripting, enrichment, and data analysis.
Lead threat hunts in newly acquired or integrating M&A environments, including assessing unfamiliar architectures, establishing baselines, identifying inherited risk and latent compromise, and investigating pre- and post-acquisition adversary activity.
Inform M&A integration and risk-reduction strategies through threat hunting findings.
Provide technical direction, standards, and mentorship through threat hunting expertise.