SOC Threat Hunter

ECS Tech Inc•Portland, OR

3d•Onsite

About The Position

The Threat Hunter proactively identifies, investigates, and helps mitigate advanced cyber threats that may evade automated detection and traditional monitoring. This role develops threat hypotheses, analyzes endpoint, network, cloud, identity, and security event data, and conducts structured hunts to uncover suspicious behaviors, attacker techniques, and control gaps. The ideal candidate has strong analytical skills, hands-on experience with security monitoring and investigation tools, and the ability to translate threat research into repeatable hunt procedures, detection improvements, and actionable findings for SOC, incident response, engineering, and threat intelligence stakeholders. This role involves shift work schedule to support our 24/7 operation, including weekends and holidays. Candidates must be flexible in their availability. While we make every effort to accommodate individual preferences, it's essential to understand that specific shift requests are not guaranteed and are assigned based on operational needs.

Requirements

U.S. Citizenship with ability to obtain and maintain a DOE “L” clearance after start.
5+ years of experience in cybersecurity operations, threat hunting, incident response, detection engineering, security monitoring, or related roles
Hands-on experience using SIEM, EDR, network security, endpoint telemetry, cloud logging, and/or log analytics platforms
Strong understanding of adversary tactics, techniques, and procedures; common attack paths; and enterprise security controls
Experience developing or using hunt hypotheses, detection logic, investigative queries, and analytic playbooks
Ability to analyze large volumes of security data and distinguish suspicious activity from benign behavior
Strong written communication skills, including the ability to document findings, evidence, and recommendations clearly

Responsibilities

Develop and execute hypothesis-driven hunts across enterprise, cloud, endpoint, identity, and network data sources
Analyze anomalous behavior, suspicious activity, and attacker tactics, techniques, and procedures (TTPs)
Use SIEM, EDR, network, log analytics, and threat intelligence tools to identify potential compromise or unauthorized activity
Validate hunt findings, assess potential impact, and determine whether escalation to incident response or SOC operations is required
Translate hunt findings into detection logic, analytic requirements, alert tuning recommendations, and monitoring use cases
Identify gaps in logging, visibility, correlation logic, and alert coverage
Partner with SOC analysts, Splunk engineers, security engineers, and threat intelligence analysts to improve detection fidelity and coverage
Support development of repeatable hunt playbooks, queries, dashboards, and analytic procedures
Research emerging threats, adversary behaviors, malware trends, vulnerabilities, and exploitation techniques relevant to the environment
Map threat activity and hunt hypotheses to recognized frameworks such as MITRE ATT&CK
Incorporate threat intelligence into hunt planning, detection enhancement, and investigative workflows
Provide feedback to threat intelligence teams on observed activity, intelligence gaps, and collection priorities
Support advanced investigations by correlating security events, system activity, user behavior, and contextual data
Document investigative steps, evidence, conclusions, and recommended follow-up actions
Coordinate with SOC Tier 2 and Tier 3 analysts, forensics personnel, and incident response teams during escalations
Assist with post-incident hunt activity to identify related indicators, lateral movement, persistence, or additional affected assets
Produce clear hunt reports, summaries, findings, and recommendations for technical and leadership audiences
Track hunt outcomes, recurring patterns, detection gaps, and operational metrics
Contribute to continuous improvement of SOC processes, analytic standards, and knowledge management resources
Stay current with adversary tradecraft, detection engineering practices, and security analytics techniques