Threat Hunter

ShorePoint•Herndon, VA

1d•Remote

About The Position

ShorePoint is seeking a Threat Hunter to support and enhance its 24/7 Security Operations Center (SOC). The role combines advanced threat detection, incident investigation, and proactive threat hunting with hands-on development of SIEM use cases, automation, and analytics to identify and respond to sophisticated threats, including lateral movement. The successful candidate will bring strong investigative expertise and a builder mindset to continuously improve detection capabilities and SOC effectiveness. The position supports 24x7x365 SOC operations and involves monitoring and investigating security events, developing and tuning SIEM detections, automating SOC and incident response functions, supporting threat intelligence operations, and producing documentation and reporting. The Threat Hunter will also coordinate with internal teams and stakeholders on threat hunting, insider threat, testing, and after-action activities, participate in a rotating on-call schedule, and contribute to continuous SOC improvement. The position is remote in Herndon, Virginia, with working hours of 8:45 AM to 5:15 PM Eastern Time.

Requirements

At least 5 years of technical experience.
Ability to work 8:45 AM to 5:15 PM Eastern Time.
Ability to participate in a rotating SOC on-call schedule.
U.S. citizenship, as required for federal contract compliance.
Deep understanding of cyber threat tactics, techniques, and procedures (TTPs), threat hunting methodologies, and application of the MITRE ATT&CK framework.
Experience supporting 24x7x365 SOC operations, including alert monitoring, triage, analysis, response, and review/action of threat intelligence and reported incidents.
Ability to manage multiple alerts and tickets in parallel, perform end-to-end triage through resolution, prioritize response actions, and coordinate with end-users.
Strong experience analyzing and correlating security events across endpoint, network, email security, SIEM, and federal threat intelligence sources such as CISA.
Demonstrated proficiency with one or more toolsets such as Bit9/Carbon Black, CrowdStrike, FireEye ETP, and Elastic Kibana.
Experience analyzing security events generated by tools and devices such as Carbon Black, CrowdStrike, FireEye, Palo Alto, Cylance, and OSSEC.
Hands-on experience with enterprise SIEM or security analytics platforms such as Elastic Stack or Splunk, including log analysis, event correlation, and detection support.
Experience with malware analysis and understanding attack vectors involving malware, data exposure, phishing, and social engineering.
Experience developing and maintaining SOPs, performing event timeline analysis, and investigating logs across Windows and Linux environments and network security devices.
Critical thinking skills to break down complex, ambiguous problems into actionable tasks and determine appropriate courses of action.

Nice To Haves

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Mathematics, Engineering, or a related field.
One or more of the following certifications: GIAC (GCIH, GCFE, GCFA, GREM, GNFA, GCTI, GPEN, GWAPT), CEPT, CASS, CWAPT, or CREA.

Responsibilities

Provide first-line SOC support, including alert monitoring, triage, routing, escalation, and response across 24x7x365 operations.
Monitor, analyze, and investigate security events, network traffic, and host-based detections, distinguishing malicious activity from false positives.
Conduct proactive threat hunting and anomaly detection across SIEM and security tools to identify patterns, lateral movement, and emerging threats.
Conduct incident investigations, Cyber Threat Assessment, and Remediation Analysis, including processing and correlating incident indicators with threat intelligence.
Tune and develop SIEM correlation rules and detection logic, and build detection use cases in collaboration with incident response teams.
Develop and maintain scripts and tools, including Python and Bash, to automate SOC and incident response functions such as IoC ingestion, log processing, and SIEM integrations via APIs.
Research, develop, and maintain dashboards, visualizations, and analytics for detection, reporting, and SOC performance monitoring.
Produce, review, and maintain documentation and reporting, including cybersecurity briefings, metrics, incident reports, and stakeholder deliverables, in alignment with editorial standards and government specifications.
Support threat intelligence operations by reviewing and actioning IoCs and translating intelligence into actionable detections.
Coordinate with internal teams and stakeholders on Insider Threat, Rules of Engagement, threat hunting, testing activities, and after-action reporting.
Support SOC processes, including ticket tracking, customer security assessments, ad hoc investigations, tabletop exercises, and lessons learned.
Improve SOC detection capabilities, processes, communication, and operational effectiveness, and participate in an on-call rotation.