Signals and Defense Engineer, Senior

Booz Allen Hamilton•McLean, VA

About The Position

The Senior Signals and Defense Engineer role focuses on investigating security events and incidents and proactively hunting for malicious activity that may evade existing security controls. The position combines incident response activities—including triage, investigation, containment, eradication, and recovery—with hypothesis-driven threat hunting to identify adversary behavior, detection gaps, and opportunities to improve security visibility. The analyst conducts investigations independently and collaborates with senior analysts, threat hunters, detection engineers, incident responders, and partner teams during complex events. U.S. citizenship is required due to the nature of the work performed at the facility. The role investigates activity across endpoint, network, identity, cloud, application, and infrastructure environments. It uses security telemetry, SIEM and EDR/XDR platforms, cloud security tools, threat intelligence, and analytics to determine incident scope, severity, impact, and potential root cause; develop and execute hunts; and translate findings into detection improvements. The position also contributes to incident response procedures, threat hunting playbooks, investigation guides, SOC procedures, and post-incident reviews. Booz Allen offers health, life, disability, financial, and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. The projected annualized compensation range is $86,800 to $198,000. Salary is determined by factors including location, qualifications, experience, and organizational or contract requirements.

Requirements

3 or more years of cybersecurity experience with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations.
Experience conducting hypothesis-driven threat hunts to identify activity that may not be detected by existing security controls.
Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry for indicators of compromise, anomalous behavior, and potential attack activity.
Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze security telemetry during investigations and hunts.
Experience using AI, machine learning, automation, or agentic security technologies to assist with investigations, enrichment, correlation, or threat hunting.
Experience with cloud security investigations in environments such as AWS, Azure, or GCP, including identity activity, audit logs, workloads, and cloud-based attack techniques.
Knowledge of adversary tactics, techniques, and procedures, including practical application of MITRE ATT&CK to guide hunts and investigations.
Knowledge of Windows and Linux environments, including system logs, processes, command-line activity, authentication events, and common forensic artifacts.
Ability to transition threat-hunting findings into incident response actions, including validation, scoping, containment recommendations, eradication support, and recovery activities.
High school diploma or GED.
U.S. citizenship.

Nice To Haves

Experience conducting structured threat hunts informed by threat intelligence, adversary behaviors, MITRE ATT&CK techniques, behavioral analytics, or visibility gaps, and developing or tuning detection analytics using SIEM queries, behavioral rules, correlation logic, or detection-as-code methodologies.
Experience with scripting or automation using Python, PowerShell, Bash, SQL, or similar languages, and with security guidance such as NIST SP 800-61, MITRE ATT&CK, Cyber Kill Chain, or ISO/IEC 27035.
Experience with cloud incident response and forensic techniques involving cloud audit logs, identity services, containers, Kubernetes, Docker, or serverless workloads.
Experience conducting network analysis using packet captures, Zeek, DNS telemetry, proxy data, or network flow records, and incorporating indicators, adversary behaviors, or intelligence reporting into investigations and hunts.
Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis.
Experience in professional services, systems integration, advisory, or consulting, and working across SOC, incident response, threat hunting, detection engineering, cyber threat intelligence, cloud security, and infrastructure teams.
Knowledge of AI concepts, including detecting and identifying AI threats and attacks.
Ability to manage multiple investigations or threat-hunting activities simultaneously and prioritize work based on risk and potential business impact.
Strong analytical, investigative, collaboration, and communication skills.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field.

Responsibilities

Investigate security alerts, suspicious activity, and potential incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
Triage security incidents and determine their scope, severity, impact, and potential root cause.
Support incident containment, eradication, and recovery in coordination with incident response and partner teams.
Conduct proactive, hypothesis-driven threat hunts informed by threat intelligence, adversary behaviors, emerging attack techniques, anomalous activity, and monitoring gaps.
Develop and execute threat-hunting hypotheses aligned with adversary tactics, techniques, and procedures, including MITRE ATT&CK.
Analyze security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
Use SIEM, EDR/XDR, network and cloud security, threat intelligence, and analytics platforms for investigations and hunts.
Support cloud investigations across AWS, Azure, and GCP, including analysis of audit logs, identity activity, workloads, and container environments.
Translate investigation and hunting findings into actionable detection opportunities for detection engineering and SOC monitoring teams.
Develop, test, and recommend new detection logic or enhancements to existing alerts based on attacker behaviors and investigative findings.
Identify visibility, telemetry, and detection gaps and work with partner teams to improve security coverage.
Use automation, artificial intelligence, machine learning, and analytical tools where appropriate to accelerate investigations, correlate datasets, identify anomalies, and improve efficiency.
Collaborate with cyber threat intelligence teams to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunts.
Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response.
Document investigation findings, timelines, threat-hunting methodologies, evidence, conclusions, and recommended remediation actions.
Contribute to incident response procedures, threat-hunting playbooks, investigation guides, and SOC operating procedures.
Participate in post-incident reviews and lessons-learned activities to identify improvements to detection, response, telemetry, automation, and security controls.
Communicate technical findings clearly to technical and non-technical stakeholders.