Signals and Defense Engineer, Senior at Booz Allen in McLean, VA

Job description

Signals and Defense Engineer, Senior The Opportunity: As a Security Operations and Threat Hunt Analyst, you will investigate security events and incidents while proactively searching for malicious activity that may not have been identified through existing security controls. This position combines traditional incident response responsibilities, including triage, investigation, containment, eradication, and recovery, with hypothesis-driven threat hunting designed to identify adversary behaviors, uncover detection gaps, and improve overall security visibility. The ideal candidate is a technically capable cybersecurity professional who can independently conduct investigations while collaborating with senior analysts, threat hunters, detection engineers, and incident responders during complex events. Due to the nature of work performed within this facility, U.S. citizen ship is required . What You’ll Work On: Investigate security alerts, suspicious activity, and potential cybersecurity incidents across endpoint, network, identity, cloud, application, and infrastructure environments. Perform incident triage and determine the scope, severity, impact, and potential root cause of identified security events. Support containment, eradication, and recovery activities during cybersecurity incidents in coordination with incident response, infrastructure, cloud, and application teams. Conduct proactive threat hunts using threat intelligence, adversary behaviors, emerging attack techniques, anomalous activity, and identified gaps in existing security monitoring. Develop and execute threat hunting hypotheses aligned to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT & CK. Analyze large volumes of security tele met ry to identify patterns, anomalies, suspicious behaviors, and indicators of compromise. Use SIEM, EDR / XDR, network security, cloud security, threat intelligence, and analytics platforms to support investigations and hunting activities. Assist with cloud-based hunting and investigations across environments such as AWS, Azure, and GCP, including analysis of cloud audit logs, identity activity, workloads, and container environments. Translate investigation and threat hunting findings into actionable detection opportunities for detection engineering and SOC monitoring teams. Develop, test, and recommend new detection logic or enhancements to existing alerts based on identified attacker behaviors and investigative findings. Identify visibility, tele met ry, and detection gaps uncovered through incidents and threat hunts, and work with partner teams to improve security coverage. Leverage automation, artifi cia l intelligence ( AI ) , machine learning, and analytical tools where appropriate to accelerate investigations, correlate large datasets, identify anomalies, and improve analyst efficiency. Collaborate with cyber threat intelligence to incorporate emerging threats, adversary behaviors, campaigns, and indicators into investigations and hunting activities. Partner with detection engineering, infrastructure, cloud security, legal, and other stakeholders during investigations and incident response activities. Document investigation findings, timelines, threat hunting met hodologies, evidence, conclusions, and recommended remediation actions. Contribute to the development and continuous improvement of incident response procedures, threat hunting playbooks, investigation guides, and SOC operating procedures. Participate in post-incident reviews and lessons-learned activities to identify opportunities in improving detection, response, tele met ry, automation, and security controls. Communicate technical findings clearly to both technical and non-technical stakeholders. Join us. The world can’t wait. You Have: 3+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations Experience conductin