Signals and Defense Engineer, Mid

Booz Allen Hamilton•McLean, VA

1d•$69,400 - $158,000

About The Position

The Signals and Defense Engineer, Mid investigates security events and incidents and proactively hunts for malicious activity that existing security controls may not detect. The role combines incident response—including triage, investigation, containment, eradication, and recovery—with hypothesis-driven threat hunting to identify adversary behaviors, detection gaps, and opportunities to improve security visibility. The engineer conducts investigations independently and collaborates with senior analysts, threat hunters, detection engineers, incident responders, and partner teams during complex events. U.S. citizenship is required because of the work performed at the facility. The position covers security telemetry and investigations across endpoint, network, identity, cloud, application, and infrastructure environments. It uses SIEM, EDR/XDR, cloud security, threat intelligence, analytics, and automation tools to support investigations, hunting, and detection improvements. The engineer documents findings and contributes to incident-response procedures, hunting playbooks, investigation guides, and SOC operating procedures. Booz Allen describes a total compensation package that includes health, life, disability, financial, and retirement benefits; paid leave; professional development; tuition assistance; work-life programs; dependent care; and recognition awards. The stated annualized compensation range is $69,400 to $158,000, subject to factors including location, qualifications, experience, and organizational requirements. The position’s work model is not specified in the posting; the Work Model section describes expectations that apply depending on whether a position is listed as remote, hybrid, or onsite.

Requirements

At least 3 years of cybersecurity experience in threat hunting, incident response, security operations, detection engineering, or security investigations.
Experience conducting hypothesis-driven threat hunts to find activity that may evade existing security controls.
Experience with adversary tactics, techniques, and procedures, including practical application of MITRE ATT&CK to hunt development and investigative analysis.
Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry for indicators of compromise, anomalous behavior, and potential attacks.
Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze large volumes of telemetry.
Experience using AI, machine learning, automation, or agentic security technologies to assist security investigation, enrichment, correlation, or threat hunting.
Experience with cloud security investigations in AWS, Azure, or GCP, including identity activity, audit logs, workloads, and cloud-based attack techniques.
Knowledge of Windows and Linux environments, including system logs, processes, command-line activity, authentication events, and common forensic artifacts.
Ability to translate hunt findings into incident response actions, including validation, scoping, containment recommendations, eradication support, and recovery activities.
High school diploma or GED.
U.S. citizenship is required.

Nice To Haves

Experience conducting structured hunts based on threat intelligence, adversary behaviors, MITRE ATT&CK techniques, behavioral analytics, or security visibility gaps, and developing or tuning detection analytics using SIEM queries, behavioral rules, correlation logic, or detection-as-code methods.
Experience with scripting or automation using Python, PowerShell, Bash, SQL, or similar languages.
Experience with security frameworks and guidance such as NIST SP 800-61, MITRE ATT&CK, Cyber Kill Chain, or ISO/IEC 27035.
Experience with cloud incident response involving cloud audit logs, identity services, containers, Kubernetes, Docker, or serverless workloads.
Experience with AI concepts, including detecting and identifying AI threats and attacks.
Experience with network analysis using packet captures, Zeek, DNS telemetry, proxy data, or network flow records, and incorporating indicators, adversary behaviors, or intelligence reporting into investigations and hunts.
Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis.
Experience in professional services, systems integration, advisory, or consulting, and working across SOC, incident response, threat hunting, detection engineering, cyber threat intelligence, cloud security, and infrastructure teams.
Ability to complete investigations or threat hunting activities and directly contribute to service delivery.
Excellent analytical, investigative, and collaborative skills.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field.

Responsibilities

Investigate security alerts, suspicious activity, and potential incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
Triage security events and determine their scope, severity, impact, and potential root cause.
Support incident containment, eradication, and recovery with incident response, infrastructure, cloud, and application teams.
Conduct proactive, hypothesis-driven threat hunts using intelligence, adversary behaviors, emerging techniques, anomalous activity, and identified monitoring gaps.
Develop and execute threat hunting hypotheses aligned with adversary tactics, techniques, and procedures, including MITRE ATT&CK.
Analyze security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
Use SIEM, EDR/XDR, network security, cloud security, threat intelligence, and analytics platforms for investigations and hunts.
Assist with cloud investigations across AWS, Azure, and GCP, including analysis of audit logs, identity activity, workloads, and container environments.
Translate investigation and hunting findings into detection opportunities for detection engineering and SOC monitoring teams.
Develop, test, and recommend detection logic or improvements to existing alerts based on attacker behaviors and investigation findings.
Identify visibility, telemetry, and detection gaps and work with partner teams to improve security coverage.
Use automation, AI, machine learning, and analytical tools where appropriate to accelerate investigations, correlate data, identify anomalies, and improve analyst efficiency.
Collaborate with cyber threat intelligence teams to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunts.
Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response.
Document findings, timelines, hunting methodologies, evidence, conclusions, and recommended remediation actions.
Contribute to incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures.
Participate in post-incident reviews and lessons-learned activities to improve detection, response, telemetry, automation, and security controls.
Communicate technical findings clearly to technical and non-technical stakeholders.