Signals and Defense Engineer, Senior
Booz Allen · McLean, Virginia, United States
Signals and Defense Engineer, SeniorThe Opportunity:
As a Security Operations and Threat Hunt Analyst, you will investigate security events and incidents while proactively searching for malicious activity that may not have been identified through existing security controls. This position combines traditional incident response responsibilities, including triage, investigation, containment, eradication, and recovery, with hypothesis-driven threat hunting designed to identify adversary behaviors, uncover detection gaps, and improve overall security visibility.
The ideal candidate is a technically capable cybersecurity professional who can independently conduct investigations while collaborating with senior analysts, threat hunters, detection engineers, and incident responders during complex events. Due to the nature of work performed within this facility, U.S. citizenship is required.
What You’ll Work On:
- Investigate security alerts, suspicious activity, and potential cybersecurity incidents across endpoint, network, identity, cloud, application, and infrastructure environments.
- Perform incident triage and determine the scope, severity, impact, and potential root cause of identified security events.
- Support containment, eradication, and recovery activities during cybersecurity incidents in coordination with incident response, infrastructure, cloud, and application teams.
- Conduct proactive threat hunts using threat intelligence, adversary behaviors, emerging attack techniques, anomalous activity, and identified gaps in existing security monitoring.
- Develop and execute threat hunting hypotheses aligned to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
- Analyze large volumes of security telemetry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise.
- Use SIEM, EDR/XDR, network security, cloud security, threat intelligence, and analytics platforms to support investigations and hunting activities.
- Assist with cloud-based hunting and investigations across environments such as AWS, Azure, and GCP, including analysis of cloud audit logs, identity activity, workloads, and container environments.
- Translate investigation and threat hunting findings into actionable detection opportunities for detection engineering and SOC monitoring teams.
- Develop, test, and recommend new detection logic or enhancements to existing alerts based on identified attacker behaviors and investigative findings.
- Identify visibility, telemetry, and detection gaps uncovered through incidents and threat hunts, and work with partner teams to improve security coverage.
- Leverage automation, artificial intelligence (AI), machine learning, and analytical tools where appropriate to accelerate investigations, correlate large datasets, identify anomalies, and improve analyst efficiency.
- Collaborate with cyber threat intelligence to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunting activities.
- Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response activities.
- Document investigation findings, timelines, threat hunting methodologies, evidence, conclusions, and recommended remediation actions.
- Contribute to the development and continuous improvement of incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures.
- Participate in post-incident reviews and lessons-learned activities to identify opportunities in improving detection, response, telemetry, automation, and security controls.
- Communicate technical findings clearly to both technical and non-technical stakeholders.
Join us. The world can’t wait.
You Have:
- 3+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations
- Experience conducting hypothesis-driven threat hunts to identify suspicious or malicious activity that may not be detected through existing security controls
- Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise, anomalous behavior, and potential attack activity
- Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze large volumes of security telemetry during hunts and investigations
- Experience using AI, machine learning, automation, or agentic security technologies to assist with security investigation, enrichment, correlation, or threat hunting
- Experience with cloud security investigations across environments such as AWS, Azure, or GCP, including analysis of identity activity, audit logs, workloads, and cloud-based attack techniques
- Knowledge of adversary tactics, techniques, and procedures, including practical application of the MITRE ATT&CK framework to guide hunt development and investigative analysis
- Knowledge of Windows and Linux environments, including analysis of system logs, processes, command-line activity, authentication events, and common forensic artifacts
- Ability to transition threat hunt findings into incident response actions, including validation, scoping, containment recommendations, eradication support, and recovery activities
- HS diploma or GED
Nice If You Have:
- Experience conducting structured threat hunts based on threat intelligence, adversary behaviors, MITRE ATT&CK techniques, behavioral analytics, or identified security visibility gaps, and developing or tuning detection analytics using SIEM queries, behavioral rules, correlation logic, or detection-as-code methodologies
- Experience with scripting or automation using technologies such as Python, PowerShell, Bash, SQL, or similar languages, and with security frameworks and guidance such as NIST SP 800-61, MITRE ATT&CK, Cyber Kill Chain, or ISO/IEC 27035
- Experience with cloud incident response and forensic techniques involving cloud audit logs, identity services, containers, Kubernetes, Docker, or serverless workloads
- Experience performing network analysis using packet captures, Zeek, DNS telemetry, proxy data, or network flow records, and incorporating indicators, adversary behaviors, or intelligence reporting into investigations and threat hunts
- Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis
- Experience in a professional services, systems integration, advisory, or consulting environment, and working across SOC, incident response, threat hunting, detection engineering, cyber threat intelligence, cloud security, and infrastructure teams
- Knowledge of AI concepts, including detecting and identifying AI threats and attacks
- Ability to manage multiple investigations or threat hunting activities simultaneously while appropriately prioritizing work based on risk and potential business impact
- Possession of strong analytical, investigative, collaboration, and communication skills
- Bachelor’s degree in Cybersecurity, CS, Information Systems, Engineering, or a related field
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our tot