Signals and Defense Engineer, Senior

Booz Allen Hamilton•McLean, VA

8d•$86,800 - $198,000

About The Position

As a Security Operations and Threat Hunt Analyst, you will investigate security events and incidents and proactively search for malicious activity that existing security controls may not identify. The role combines incident response—including triage, investigation, containment, eradication, and recovery—with hypothesis-driven threat hunting to identify adversary behaviors, detection gaps, and opportunities to improve security visibility. You will work independently on investigations and collaborate with senior analysts, threat hunters, detection engineers, incident responders, and other stakeholders during complex events. U.S. citizenship is required due to the nature of work performed within the facility. The position uses security telemetry and platforms across endpoint, network, identity, cloud, application, and infrastructure environments. You will investigate activity in cloud environments such as AWS, Azure, and GCP, develop hunt hypotheses informed by adversary tactics and techniques, and turn findings into actionable detection improvements. You will also document investigations, contribute to playbooks and procedures, participate in post-incident reviews, and communicate findings to technical and non-technical audiences. Booz Allen describes its offerings as including health, life, and disability benefits; financial and retirement benefits; paid leave; professional development; tuition assistance; work-life programs; dependent care; and recognition awards. The projected annualized compensation range is $86,800 to $198,000. The role’s specific work location type is not stated in the posting.

Requirements

At least 3 years of cybersecurity experience with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations.
Experience conducting hypothesis-driven threat hunts to find suspicious or malicious activity not detected by existing controls.
Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise, anomalous behavior, and potential attacks.
Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze large volumes of telemetry.
Experience using AI, machine learning, automation, or agentic security technologies to assist with investigation, enrichment, correlation, or threat hunting.
Experience with cloud security investigations in environments such as AWS, Azure, or GCP, including identity activity, audit logs, workloads, and cloud attack techniques.
Knowledge of adversary tactics, techniques, and procedures, including practical use of MITRE ATT&CK to guide hunting and investigations.
Knowledge of Windows and Linux environments, including system logs, processes, command-line activity, authentication events, and common forensic artifacts.
Ability to translate hunt findings into incident response actions, including validation, scoping, containment recommendations, eradication support, and recovery activities.
High school diploma or GED.
U.S. citizenship is required.

Nice To Haves

Experience conducting structured hunts based on threat intelligence, adversary behaviors, MITRE ATT&CK techniques, behavioral analytics, or security visibility gaps, and developing or tuning detection analytics using SIEM queries, behavioral rules, correlation logic, or detection-as-code methods.
Experience with scripting or automation using Python, PowerShell, Bash, SQL, or similar languages, and with frameworks or guidance such as NIST SP 800-61, MITRE ATT&CK, Cyber Kill Chain, or ISO/IEC 27035.
Experience with cloud incident response and forensics involving cloud audit logs, identity services, containers, Kubernetes, Docker, or serverless workloads.
Experience performing network analysis using packet captures, Zeek, DNS telemetry, proxy data, or network flow records, and incorporating indicators, adversary behaviors, or intelligence reporting into investigations and hunts.
Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis.
Experience in professional services, systems integration, advisory, or consulting, and working across SOC, incident response, threat hunting, detection engineering, cyber threat intelligence, cloud security, and infrastructure teams.
Knowledge of AI concepts, including detecting and identifying AI threats and attacks.
Ability to manage multiple investigations or hunting activities simultaneously and prioritize work based on risk and potential business impact.
Strong analytical, investigative, collaboration, and communication skills.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field.

Responsibilities

Investigate security alerts, suspicious activity, and potential incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
Triage security events and determine their scope, severity, impact, and potential root cause.
Support incident containment, eradication, and recovery with incident response, infrastructure, cloud, and application teams.
Conduct proactive threat hunts informed by threat intelligence, adversary behaviors, emerging techniques, anomalous activity, and security monitoring gaps.
Develop and execute threat hunting hypotheses aligned with adversary tactics, techniques, and procedures, including MITRE ATT&CK.
Analyze security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
Use SIEM, EDR/XDR, network security, cloud security, threat intelligence, and analytics platforms for investigations and hunts.
Support cloud investigations and threat hunts across AWS, Azure, and GCP, including analysis of audit logs, identity activity, workloads, and container environments.
Translate investigation and hunt findings into detection opportunities for detection engineering and SOC monitoring teams.
Develop, test, and recommend new detection logic or improvements to existing alerts based on attacker behaviors and findings.
Identify visibility, telemetry, and detection gaps and work with partner teams to improve security coverage.
Use automation, AI, machine learning, and analytical tools where appropriate to accelerate investigations, correlate datasets, identify anomalies, and improve efficiency.
Collaborate with cyber threat intelligence teams to apply emerging threats, adversary behaviors, campaigns, and indicators to investigations and hunts.
Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response.
Document investigation findings, timelines, hunting methods, evidence, conclusions, and recommended remediation actions.
Contribute to incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures.
Participate in post-incident reviews and lessons-learned activities to identify improvements to detection, response, telemetry, automation, and security controls.
Communicate technical findings clearly to technical and non-technical stakeholders.