The posting
Signals and Defense Engineer, Senior
The Opportunity:
As a Security Operations and Threat Hunt Analyst, you will investigate security events and incidents while proactively searching for malicious activity that may not have been identified through existing security controls. This position combines traditional incident response responsibilities, including triage, investigation, containment, eradication, and recovery, with hypothesis-driven threat hunting designed to identify adversary behaviors, uncover detection gaps, and improve overall security visibility.
The ideal candidate is a technically capable cybersecurity professional who can independently conduct investigations while collaborating with senior analysts, threat hunters, detection engineers, and incident responders during complex events. Due to the nature of work performed within this facility, U.S. citizenship is required.
What You’ll Work On:
- Investigate security alerts, suspicious activity, and potential cybersecurity incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
- Perform incident triage and determine the scope, severity, impact, and potential root cause of identified security events.
- Support containment, eradication, and recovery activities during cybersecurity incidents in coordination with incident response, infrastructure, cloud, and application teams.
- Conduct proactive threat hunts using threat intelligence, adversary behaviors, emerging attack techniques, anomalous activity, and identified gaps in existing security monitoring.
- Develop and execute threat hunting hypotheses aligned to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
- Analyze large volumes of security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
- Use SIEM, EDR/XDR, network security, cloud security, threat intelligence, and analytics platforms to support investigations and hunting activities.
- Assist with cloud-based hunting and investigations across environments such as AWS, Azure, and GCP, including analysis of cloud audit logs, identity activity, workloads, and container environments.
- Translate investigation and threat hunting findings into actionable detection opportunities for detection engineering and SOC monitoring teams.
- Develop, test, and recommend new detection logic or enhancements to existing alerts based on identified attacker behaviors and investigative findings.
- Identify visibility, telemetry, and detection gaps uncovered through incidents and threat hunts, and work with partner teams to improve security coverage.
- Leverage automation, artificial intelligence (AI), machine learning, and analytical tools where appropriate to accelerate investigations, correlate large datasets, identify anomalies, and improve analyst efficiency.
- Collaborate with cyber threat intelligence to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunting activities.
- Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response activities.
- Document investigation findings, timelines, threat hunting methodologies, evidence, conclusions, and recommended remediation actions.
- Contribute to the development and continuous improvement of incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures.
- Participate in post-incident reviews and lessons-learned activities to identify opportunities in improving detection, response, telemetry, automation, and security controls.
- Communicate technical findings clearly to both technical and non-technical stakeholders.
Join us. The world can’t wait.
You Have:
- 3+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations
- Experience conducting hypothesis-driven threat hunts to identify suspicious or malicious activity that may not be detected through existing security controls
- Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise, anomalous behavior, and potential attack activity
- Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze large volumes of security telemetry during hunts and investigations
- Experience using AI, machine learning, automation, or agentic security technologies to assist with security investigation, enrichment, correlation, or threat hunting
- Experience with cloud security investigations across environments such as AWS, Azure, or GCP, including analysis of identity activity, audit logs, workloads, and cloud-based attack techniques
- Knowledge of adversary tactics, techniques, and procedures, including practical application of the MITRE ATT&CK framework to guide hunt development and investigative analysis
- Knowledge of Windows and Linux environments, including analysis of system logs, processes, command-line activity, authentication events, and common forensic artifacts
- Ability to transition threat hunt findings into incident response actions, including validation, scoping, containment recommendations, eradication support, and recovery activities
- HS diploma or GED
Nice If You Have:
- Experience conducting structured threat hunts based on threat intelligence, adversary behaviors, MITRE ATT&CK techniques, behavioral analytics, or identified security visibility gaps, and developing or tuning detection analytics using SIEM queries, behavioral rules, correlation logic, or detection-as-code methodologies
- Experience with scripting or automation using technologies such as Python, PowerShell, Bash, SQL, or similar languages, and with security frameworks and guidance such as NIST SP 800-61, MITRE ATT&CK, Cyber Kill Chain, or ISO/IEC 27035
- Experience with cloud incident response and forensic techniques involving cloud audit logs, identity services, containers, Kubernetes, Docker, or serverless workloads
- Experience performing network analysis using packet captures, Zeek, DNS telemetry, proxy data, or network flow records, and incorporating indicators, adversary behaviors, or intelligence reporting into investigations and threat hunts
- Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis
- Experience in a professional services, systems integration, advisory, or consulting environment, and working across SOC, incident response, threat hunting, detection engineering, cyber threat intelligence, cloud security, and infrastructure teams
- Knowledge of AI concepts, including detecting and identifying AI threats and attacks
- Ability to manage multiple investigations or threat hunting activities simultaneously while appropriately prioritizing work based on risk and potential business impact
- Possession of strong analytical, investigative, collaboration, and communication skills
- Bachelor’s degree in Cybersecurity, CS, Information Systems, Engineering, or a related field
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual’s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen’s total compensation package for employees. This posting will close within 90 days from the Posting Date.
Identity Statement
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.
Candidate AI Usage Policy
AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on your own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited unless permission is explicitly provided.
Work Model Our people-first culture prioritizes the benefits of collaboration. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.
- Remote: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.
- Hybrid: If this position is listed as hybrid, you will be expected to work from a Booz Allen or customer facility, in alignment with your leadership's expectations and the needs of the role.
- Onsite: If this position is listed as onsite, work will primarily be performed full-time at a customer facility, where employees will collaborate directly with colleagues and customers as required by the role.
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.
