Cyber Threat Hunter

Cyber Threat Hunter

Overview

Edgewater Federal Solutions is currently seeking a Threat Hunter to provide threat hunting expertise and support to maximize cyber fusion throughout the Client’s SOC, ensuring the Client’s infrastructure and operations remain safe and secure from the full spectrum of cyber threats.

The Threat Hunter will support Client SOC teams by providing industry-leading threat hunt support to ongoing and significant incidents as well as by engaging in proactive, hypothesis-driven hunts for threats assumed to already be in the Client environment who may have evaded existing detections. Additionally, the Threat Hunter must be skilled in related disciplines including incident response, forensics, and malware analysis, and be able to integrate these skills to assist in the closure of cybersecurity incidents.

**Due to the nature of the contract and work, US Citizenship is required**

Responsibilities

• Respond to crisis or urgent situations to mitigate immediate and potential threats.
• Investigate and analyze all relevant response activities, identifying and assessing the capabilities and activities of the full spectrum of cyber threats.
• Review and analyze risk-based Security Information and Event Management (SIEM) alerts to develop hunt hypotheses.
• Utilize open-source intelligence to inform hunt hypothesis development.
• Propose, discuss, and document custom searches for automated detection of threat actor activity based on hunt findings.
• Track and document cybersecurity incidents from detection to resolution.
• Participate in government-led after-action reviews of incidents.
• Triage malware events to identify the root cause of specific activity.
• Provide computer forensic support to high technology investigations, including evidence seizure, computer forensic analysis, and data recovery.
• Conduct malware analysis in out-of-band environments, including static and dynamic analysis of complex malware.
• Monitor and assess complex security devices for patterns and anomalies, tagging events for Tier 1 & 2 monitoring.
• Configure, deploy, and troubleshoot Endpoint Detection and Response agents (e.g., Crowdstrike and Sysmon).
• Collect and analyze data from compromised systems using EDR agents and custom scripts.
• Interface with IT contacts to install or diagnose problems with EDR agents.
• Plan, conduct, and document iterative, hypothesis-based hunts using the Agile Scrum project management methodology.
• Attend daily Agile Scrum standups and report progress on assigned Jira stories.