Threat Hunting

Threat Hunting Engineer Jobs

14 jobs found

12d ago

Staff Security Engineer, Cloud Detection & Response

Aurora Dallas, TX

Dallas, TX

12d ago

$171k - $303k/yr Full time Analytics Cloud Platforms Cyber Security

Apply Now

Job Description

Aurora’s Detection & Response team is building stronger cloud and enterprise security capabilities through better telemetry, detection engineering, and incident readiness. As a Staff Security Engineer on the Cloud Detection & Response team, you will help mature detection infrastructure across multi-quarter, cross-functional initiatives, partnering with engineering and SOC stakeholders to expand coverage and improve outcomes for real-world threats.

Location: Dallas, TX (onsite)
Compensation: USD 171,000 - 303,000 per year
Experience: 10+ years

What you’ll do

Lead cross-functional efforts to mature detection infrastructure, including log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD, and scalable telemetry collection that considers cost.
Increase detection coverage across cloud and enterprise environments, prioritizing high-impact coverage improvements.
Design, build, and tune detections for cloud control plane and workload activity, identity-based attacks, endpoint, and SaaS threats, including abuse of CI/CD and service-to-service communication paths.
Partner with Cloud Infrastructure, IT, and Platform Engineering to embed logging and detection requirements into system design, and represent Detection & Response in working groups and design reviews.
Integrate threat intelligence and adversary emulation into coverage priorities, and run proactive threat hunting across cloud, identity, endpoint, and SaaS data.
Handle cloud and enterprise security incidents and participate in an on-call rotation, using lessons learned to drive improvements to detections and infrastructure.
Collaborate with and mentor SOC engineers on cloud and enterprise detection practices, and contribute to quarterly planning for detection infrastructure and coverage initiatives.

What you bring

10+ years of security experience, including leading cross-functional security projects or programs from scoping through delivery.
Strong technical foundation in threat detection and incident response.
Expertise in cloud security across one or more major providers, including cloud-native telemetry and detection sources.
Experience building or maturing detection infrastructure such as SIEM or security data lake pipelines, log onboarding/normalization, and detection-as-code workflows.
Expertise with EDR and SaaS security monitoring, or comparable depth across host and application telemetry.
Ability to author and maintain detections (anomalous, network, host, identity, and cloud activity) and measure detection coverage against adversary behavior.
Experience in incident management and driving cross-departmental collaboration for containment and remediation.
Expertise with MITRE ATT&CK and modern adversarial techniques, and understanding of NIST CSF.
Ability to write quality, testable Python.

Helpful experience

Experience designing and implementing Zero Trust Architecture.
Experience scaling SOC and Detection Engineering with AI/LLM.
Experience building and architecting data lakes.
Experience with compliance frameworks such as SOC 2 and ISO 27001.

Technologies you’ll work with

Python
MITRE ATT&CK
NIST CSF
SIEM
detection-as-code
CI/CD
EDR

Additional location and pay details

For roles based in Mountain View, the salary range is $189,000 - $303,000 per year.
For roles based in Pittsburgh, PA, the salary range is $171,000 - $273,000 per year.

Aurora’s pay ranges are determined by role, level, and location. Within the range, starting base pay is based on job-related skills, experience, qualifications, relevant education or training, and market conditions. Ranges may be modified in the future. The successful candidate may also be eligible for an annual bonus, equity compensation, and benefits.

Working at Aurora

Aurorans are expected to work from the office at least 3 days per week, with some roles requiring more frequent in-office presence, up to 5 days per week, based on operational needs.

View full job page →

20d ago

Cybersecurity GRC Engineer

X Energy, LLC Gaithersburg, MD

Gaithersburg, MD

20d ago

$113k - $128k/yr Full time Cloud Platforms Cloud Security Cybersecurity Tools

Apply Now

Job Description

X Energy, LLC is building the Xe-100 advanced nuclear reactor, and this role focuses on strengthening cybersecurity governance, risk management, and compliance (GRC) across the plant lifecycle for nuclear facility design and engineering. The position is hybrid in Gaithersburg, MD and comes with a salary range of USD 112,500 to 128,250 per year, plus benefits designed to support your health and long-term planning.

Benefits

401K plan with an employer match
Medical/Dental/Vision Insurance
Life and Disability Insurance
Paid Time Off
Tuition Reimbursement/Professional Development policy

Responsibilities

Execute advanced threat hunt operations using known adversary tactics, techniques, and procedures, along with indicators of attack to detect adversaries.
Develop threat intelligence to detect, respond to, and help defeat advanced persistent threats (APTs).
Develop and produce reports on activities and incidents to support day-to-day status, trend development, and situational awareness across security issues.
Identify and remediate control weaknesses.
Review data with firewall administrators, engineering, system administrators, and other teams to determine the risk associated with security events.
Perform complex, senior-level information security analysis work.
Develop and recommend plans to safeguard computer/server/network configurations and data files against accidental or unauthorized modification, destruction, or disclosure, including support for emergency data processing needs.
Execute performance and reviews of technical risk assessments for new and existing applications.
Develop and implement systems and procedures to prevent, detect, contain, and correct data security breaches.
Maintain a professional demeanor and behavior in all forms of communication.
Perform other duties as assigned by the manager.

Requirements

High school diploma or equivalent
Typically 5 years of experience in a cybersecurity role
Knowledge of ServiceNow platform capabilities, modules, and best practices
Experience in ServiceNow development and architecture
Familiarity with ITIL processes and service management principles
Technical skills including scripting, workflow configuration, and business rule development
Ability to independently design and lead complex user interfaces, integrations, and workflows
Proficiency in JavaScript, AngularJS, HTML, CSS, and ServiceNow Glide API
Knowledge and experience managing cybersecurity tools such as NDR, EDR, and SIEM
Experience with Azure and AWS
One or more of the following qualifications is required: CISSP, CISA, GIAC (Global Information Assurance Certification), GCIH, GPEN, GICSP, or equivalent
Identity and Access Management technologies including Federation, MFA, and PKI
Cloud technologies including AWS, Azure, Docker, Kubernetes, and DevSecOps
Networking, Firewall, and software-defined networking
Ability to integrate cybersecurity tools to support an enterprise-level cybersecurity program
Experience leveraging AI, Machine Learning (ML), and Orchestration to secure the environment

Technologies: ServiceNow, ITIL, JavaScript, AngularJS, HTML, CSS, ServiceNow Glide API, NDR, EDR, SIEM, Azure, AWS, Federation, Multi-Factor Authentication (MFA), Public Key Infrastructure (PKI), Docker, Kubernetes, DevSecOps, Artificial Intelligence (AI), Machine Learning (ML)

Compensation: Salary range for this position is $112,500- $128,250. Compensation ranges listed for US job postings reflect base salary only and do not include benefits or other incentives.

Employment Type: Full time - Exempt

View full job page →

25d ago

IT Security Engineer II

Kansas State University Manhattan, KS

Manhattan, KS

25d ago

$80k - $100k/yr Full time Incident Response Information Security InfoSec

Apply Now

Job Description

Kansas State University is seeking an IT Security Engineer II to support the Infrastructure Security team with daily cyber security protection and detection. This on-site role focuses on keeping the organization’s security posture strong through real-time monitoring, alert triage, incident response, and threat hunting. If you value hands-on security operations and want a supportive, inclusive workplace with benefits that support well-being and work-life balance, this position aligns with that mission.

What you’ll do

Implement and manage day-to-day cyber security protection and detection technologies.
Monitor and defend the organization’s security posture through real-time analysis, incident response, and threat detection.
Perform triage of security alerts.
Execute incident response procedures.
Conduct threat hunting using security tools.
Resolve advanced technical challenges, including tuning monitoring systems.
Assist in deploying and configuring security technologies.
May provide guidance and mentoring to other staff.

What you’ll need

A high school diploma (or equivalent) and seven years of relevant experience.
Proficiency applying security technologies, standards, and best practices in an operational context.
Practical experience collaborating with vendors and understanding contractual aspects to support security initiatives.
Good communication and interpersonal skills to work effectively as part of a team and interact with stakeholders across the organization.
Demonstrated ability to implement strategic infrastructure security initiatives with a focus on practical deployment and improving defensive capabilities.
Solid knowledge of cybersecurity principles, best practices, and frameworks, with a focus on safeguarding IT infrastructure and ensuring data integrity.
Practical experience with the technical aspects of security architecture, including operating and managing security systems and tools.
Understanding of budget considerations in security operations to support efficient use of resources.
Skills applying current and emerging security technologies to meet operational needs.
Ability to contribute to operational efficiency across the security team and protection of the IT infrastructure.
Experience participating in security projects, supporting project management activities, and contributing to security enhancements.
Strong analytical and operational problem-solving focused on practical security solutions.
Ability to support senior leadership by helping operationalize security strategy through insights and recommendations.

Compensation and work setup

Location: Manhattan, KS, United States (on-site)
Pay range: USD 80,000 - 100,000 per year

Benefits and culture

Kansas State University offers a supportive and inclusive community with a focus on professional growth. Many roles include comprehensive packages supporting well-being and work-life balance, including health and life insurance, retirement plans, and generous paid time off.

Remote, hybrid, and relocation details

Some positions may be eligible for remote or hybrid working arrangements.
If working remotely or hybrid for K-State, the employee must reside within the United States to comply with federal and state laws, filings, or tax requirements.
Remote and hybrid arrangements are not available to anyone who resides in Idaho.
Kansas participates in the MakeMyMove program, which connects eligible newcomers with participating communities offering financial incentives, housing support, and local perks.

Application process

Resume
Cover Letter
Three Professional References

Applications close on: November 20, 2026

Work authorization and sponsorship

Candidates must be legally authorized to work in the U.S. on an ongoing basis without sponsorship.
Employees must be authorized to work in the United States at the time of employment.
Visa sponsorship eligibility depends on factors including occupational requirements, specific duties, wage level, candidate qualifications (such as degree field), and available departmental resources.
Not all positions or applicants will be eligible for sponsorship.

Background screening and interview preferences

Upon acceptance of a contingent offer of employment, a candidate may be subject to a background check per K-State’s background check policy.

Kansas State University honors interview preferences for qualified applicants who are veterans or individuals with disabilities. Eligible applicants who meet the minimum qualifications, submit all required application materials, and provide required preference documentation by the closing date will be granted a first-level interview.

View full job page →

1mo ago

Senior Security Engineer - Digital Forensics and Incident Response (DFIR)

Intuit Frisco, TX

Frisco, TX

1mo ago Closed

Full time Agent Ai Security Cloud Platforms

This position is no longer accepting applications (closed Oct 18, 2026).

Job Description

Intuit’s Digital Forensics and Incident Response (DFIR) team within the Security Operations Center (SOC) is hiring a Senior Security Engineer to drive investigations, detection improvements, and emerging AI/agentic risk response.

Responsibilities

Oversee and promptly respond to escalated security events or investigations; activate the Security Incident Response Plan when required.
Provide on-call support for critical severity issues, coordinate communications, and report incident status to the appropriate stakeholders.
Lead forensic analysis to determine root cause, scope, and impact of security incidents.
Investigate and respond to incidents involving AI/LLM-based tools and agentic platforms, including data leakage, insecure output handling, and unauthorized model access.
Extend incident response playbooks to cover generative AI and AI SOC platform risks.
Develop, maintain, and improve incident response plans, procedures, and playbooks to enable swift action and support regulatory compliance.
Use AI SOC platforms and frontier AI tools to accelerate triage, detection tuning, investigation, and documentation, and evaluate new AI capabilities during onboarding.
Provide guidance and training on security best practices and incident response to organizational partners, aligned with business objectives and compliance requirements.
Mentor and train incident responders on incident handling, forensic analysis, and cloud security forensics best practices.
Collaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.
Assess vulnerabilities, propose remediation strategies, and stay current on emerging security trends, threats, and countermeasures.

Requirements

3-5 years of experience in a dedicated cybersecurity role with strong emphasis on digital forensics and incident response.
Bachelor’s degree or higher in Technology, Computer Science, Cybersecurity, or related field, or equivalent hands-on experience (preferred).
1-3 years writing scripts or code in Bash, PowerShell, or Python to automate security work.
Comfort using AI coding assistants and AI SOC platforms to build faster, with awareness of risks introduced by AI-generated code.
Working knowledge of AI/LLM security risks and mitigations, including data exfiltration, insecure output handling, model and data supply chain risk, and shadow AI usage.
Familiarity with frameworks such as OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF.
Experience performing analysis and detection engineering using Endpoint Detection and Response or Cloud Security Posture Management tools such as CrowdStrike Falcon and Wiz.
Proven threat hunting experience using hypothesis-driven hunts across endpoint, cloud, and network telemetry to uncover threats that evade existing detections.
Comprehensive understanding of cybersecurity, networking, and cloud fundamentals, including frameworks such as OWASP, MITRE ATT&CK, NIST, and CIS.
Experience using and defending public cloud services: AWS, Azure, and GCP (IAM, CI/CD Pipelines, Network Security, DLP).
Deep understanding of SIEM solutions such as Splunk and LogScale.
Strong analytical and problem-solving skills focused on root cause identification and assessing risk exposure.
Exceptional communication skills (verbal and written) to explain technical details to non-technical audiences and support stakeholder relationships.
Self-motivated and able to work autonomously, managing tasks effectively and seeking assistance when necessary.
Ability to work under pressure in a dynamic environment, prioritizing tasks to meet tight deadlines while maintaining procedural discipline.
Proficiency in digital forensics technologies and methodologies, and expertise in the Security Incident Response Lifecycle based on frameworks like NIST or SANS.
Adaptable and proactive approach with willingness to take on varied responsibilities and continuously learn.
Industry-recognized certifications (advantageous), such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP, or emerging AI security credentials.

Technologies

Bash
PowerShell
Python
AWS Security Specialty
GCIH
GCFA
GFCE
CISSP
AWS
Azure
GCP
IAM
CI/CD Pipelines
Network Security
DLP
CrowdStrike Falcon
Wiz
Splunk
LogScale
Security Information and Event Management (SIEM)
Endpoint Detection and Response
Cloud Security Posture Management
OWASP Top 10 for LLM Applications
MITRE ATLAS
NIST AI RMF
OWASP
MITRE ATT&CK
NIST
CIS
SANS
AI coding assistants
AI SOC platforms
frontier AI tools

Location

Frisco, TX (onsite)

Compensation and Benefits

May be eligible for a cash bonus, equity rewards, and benefits in accordance with applicable plans and programs.

View full job page →

2mo ago

Staff Security Engineer, Security Operations

ServiceNow Mountain View, CA

Mountain View, CA

2mo ago Closed

Full time Agent Agent Orchestration Agentic Systems

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Level up your security impact with autonomous, AI-driven SOC capabilities. In this Staff Security Engineer role on ServiceNow’s Moveworks Security team, you will design and implement incident response and proactive threat hunting powered by multi-agent frameworks and Model Context Protocol (MCP). The work is highly engineering-focused, with opportunities to architect resilient automation that helps corporate systems become “automation-ready,” while partnering across Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure.

Location: Mountain View, CA (onsite).
Minimum experience: 5 years.

Responsibilities

Build and orchestrate agentic security workflows: move beyond basic tool configuration to develop, code, design, and research advanced framework-level approaches for chaining MCP servers and AI agents.
Stand up proactive threat hunting: architect and scale a proactive threat hunting program from scratch.
Close the security feedback loop: create a high-signal feedback loop between the Blue Team and ServiceNow’s internally developed AI Red Team Agent.
Partner across engineering and compliance: collaborate with IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are natively automation-ready.
Own the incident response engineering roadmap: drive the end-to-end incident response lifecycle (Detection, Triage, Containment, Recovery) and replace traditional SOAR workflows with resilient, agentic orchestration.
Escalation for complex incidents: serve as a high-tier technical escalation point for active, complex incidents.
Prove reliability with simulation testing: design, execute, and validate automated simulation tests to demonstrate that agentic workflows and detection pipelines trigger reliably against real-world attack behaviors.

Requirements

U.S. Citizenship Required: must meet strict compliance/FedRAMP criteria.
Experience: 8–10 years in Security Operations, Systems Engineering, or DevSecOps (minimum 5 years of highly relevant engineering experience required).
Cross-functional mastery: 3–5 years of proven experience working closely across Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT.
AI and agentic fluency: deep familiarity with modern LLM agent frameworks, including active research into application, performance trade-offs, and behavioral guardrails.
Automation engineering: high proficiency in Python and software engineering principles.
Cloud and infrastructure depth: hands-on architectural familiarity with AWS security ecosystems (IAM, CloudTrail, GuardDuty) and containerized environments (Kubernetes/EKS).
FedRAMP and trust awareness: communication skills and security compliance maturity to translate framework controls into automated, code-driven evidence generation pipelines.
Team and collaboration dynamics: high-autonomy, high-collaboration mindset.

Technologies

Python, Model Context Protocol (MCP), LLM agent frameworks, MCP servers, AWS security ecosystems, IAM, CloudTrail, GuardDuty, Kubernetes, EKS, SOAR.

Work Persona / Location Notes

Work personas (flexible, remote, or required in office) are assigned based on work nature and assigned work location.
To determine eligibility, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.

View full job page →

2mo ago

Cybersecurity Engineer

HB Mechanical Group, LLC Miami, FL

Miami, FL

2mo ago Closed

Full time Cloud Platforms Cybersecurity Tools Endpoint Security

This position is no longer accepting applications (closed Sep 12, 2026).

Job Description

HB Mechanical Group, LLC (HB Global) is seeking a hands-on Cybersecurity Engineer to serve as the day-to-day owner of cybersecurity operations and engineering across the enterprise. This role translates security strategy into managed controls, with direct involvement in monitoring, threat hunting, incident response, and the implementation and upkeep of security tooling across multiple divisions.

Based in Florida for a hybrid setup, this position blends operational security work with control standardization, reporting, and cross-division onboarding as HB Global grows.

Key Responsibilities

Conduct day-to-day threat hunting, monitoring, and alert triage using the CrowdStrike Falcon platform, including EDR, NG-SIEM, and Identity Threat Protection.
Investigate, contain, and remediate incidents end to end, completing root-cause analysis and documenting findings and lessons learned.
Tune detections, correlation rules, and alerting to reduce noise and improve alert fidelity.
Monitor and respond to email-borne threats and user-reported phishing through Mimecast, including quarantine management and policy tuning.
Implement, configure, and maintain security controls across Microsoft Azure and on-premises systems, coordinating with third-party architects when solution design requires it.
Administer identity and access security across Microsoft Entra ID / Active Directory, Okta, Microsoft 365, and Google Workspace, enforcing least privilege, MFA, and conditional access.
Manage endpoint protection and DNS-layer security with Cisco Umbrella, and support Cisco Meraki network security policy in partnership with the Senior Network Administrator.
Own vulnerability management, including scanning, prioritization, and coordination of remediation within the IT team.
Partner with the Senior Systems Administrator for data protection and recovery tools (Druva, Veeam) to validate backup integrity and participate in disaster-recovery testing.
Manage secrets and credential platforms with 1Password, promoting strong credential hygiene across the organization.
Maintain security configuration standards and hardening baselines aligned to leadership strategy.
Plan, track, and report on security initiatives using Zoho Projects.
Manage day-to-day relationships with security vendors and managed-service providers, holding third parties accountable to commitments.
Own the Mimecast security-awareness program, including quarterly training scheduling and management and quarterly phishing simulations, with progress and completion reporting.
Produce clear reporting on overall cybersecurity posture, translating technical detail into concise summaries for leadership and executive audiences.
Pull and correlate data from the security stack (including CrowdStrike, Mimecast, Cisco Umbrella and Meraki, identity, and vulnerability tools) into reports and dashboards.
Define and track security metrics and KPIs such as detection and response times, vulnerability remediation, patch status, and phishing-test results, reporting trends over time.
Provide on-demand snapshots of security state and communicate risks, priorities, and recommendations clearly to non-technical stakeholders.
Work with multiple semi-autonomous divisions to deliver consistent security protections while adapting engagement and communication to division operational needs and maintaining enterprise standards.
As HB Global grows, onboard and standardize security controls for new business units into the HB Global baseline.
Assess security posture of incoming environments and build practical plans to consolidate identity, endpoint, email, network, and backup protections.
Support compliance, audit, and cyber-insurance requirements with clear evidence and documentation.
Partner with leadership to convert security strategy into hands-on execution and flag emerging risks and priorities.
Coordinate closely with the Senior Network Administrator to validate network security controls and provide backup and cross-coverage for the network security function.
Perform other duties as assigned.

Required Qualifications

5+ years of hands-on experience in cybersecurity engineering, security operations, or a blended security/IT role.
Proven ability to both build and operate security controls with minimal supervision as a security generalist.
Hands-on experience with EDR/endpoint security and SIEM (with CrowdStrike strongly preferred).
Strong identity and access management experience across Entra ID / Active Directory, Okta, MFA, and conditional access.
Experience securing Microsoft 365 and cloud environments (including Microsoft Azure).
Practical incident response and threat hunting, with solid networking and firewall fundamentals.
Experience working with outside security vendors and managed services, coordinating deliverables for timelines and quality.
Working knowledge of security frameworks and best practices (including NIST Cybersecurity Framework and CIS Controls) and the ability to enforce data and access security policies.
Scripting and automation ability using PowerShell and/or Python.
Strong analytical and problem-solving skills, including clear communication to technical and non-technical stakeholders.
Ability to pull data from multiple security platforms and present cybersecurity posture in clear reports and dashboards for executive audiences.
Extensive knowledge of Microsoft Entra ID / Active Directory, Microsoft 365, and Azure security.
Familiarity with email security, DNS security, and backup/disaster-recovery concepts.
Familiarity with confidentiality requirements related to IT operations and network information.

Technology Experience

CrowdStrike Falcon (EDR, NG-SIEM, Identity Threat Protection)
Mimecast
Microsoft Azure
Microsoft Entra ID, Active Directory, Microsoft 365, Okta
Google Workspace
Cisco Umbrella, Cisco Meraki
Druva, Veeam
1Password
Zoho Projects
PowerShell, Python
NIST Cybersecurity Framework, CIS Controls
Security frameworks/certifications mentioned: CISSP, SSCP, CompTIA Security+, CompTIA CySA+, GIAC (GCIH, GCIA)

Education

BA/BS in Information Technology, Computer Science, Cybersecurity, or equivalent experience
High School Diploma

Benefits

Full-time position with benefits

Work Schedule & Travel

Full-time position with benefits
Hybrid Remote–On Site: prefer candidates within driving distance of the HB Mechanical Group office in Camp Hill, PA or the Tamarac, FL office, and consider strong candidates residing anywhere in the U.S. Eastern time zone
Hours may vary according to business needs
Occasional travel between HB Global offices and divisional worksites may be required
On-call availability for security incidents and urgent requests is required

Preferred Qualifications

Industry certifications such as CISSP, SSCP, CompTIA Security+/CySA+, GIAC (GCIH, GCIA), or CrowdStrike / Microsoft Azure security certifications
Direct experience with the stack: CrowdStrike, Mimecast, Cisco Meraki, Cisco Umbrella, Druva, Veeam, Google Workspace, Okta, 1Password
Experience standardizing security across multiple sites or business units within a growing, multi-entity organization
Experience integrating or supporting newly added business units
Experience in a multi-division or federated IT/security environment

Physical Requirements

Prolonged periods sitting at a desk and working on a computer
Must be able to lift up to 15 pounds at times
Ability to travel to divisions and worksites as needed

View full job page →

2mo ago

Principal Threat Intelligence Engineer

UnitedHealth Group Washington, DC 🇺🇸 Remote

Washington, DC

2mo ago Closed

$113k - $193k/yr Full time Agentic Ai Artificial Intelligence Cybersecurity Tools

This position is no longer accepting applications (closed Sep 5, 2026).

Job Description

UnitedHealth Group is seeking a Principal Threat Intelligence Engineer to expand and integrate threat intelligence capabilities across its security ecosystem. In this role, you will help operationalize intelligence-led detection and response by ingesting, normalizing, enriching, and automating threat data workflows used by CTI, SOC, IR, and other SecOps teams.

This position is based in Washington, DC with a remote work setup and a salary range of USD 112,700 to 193,200 per year. A minimum of 3+ years of relevant experience is required.

What you’ll do

Deploy, integrate, and maintain a threat intelligence platform integrated into United Health’s security tooling ecosystem
Integrate threat intelligence into SIEM platforms (example: Splunk) to support detection use cases and alert enrichment
Use agentic AI, LLMs, and related capabilities to improve the speed and availability of contextualized threat intelligence for CTI, SOC, IR, and other SecOps teams
Build and deploy technology-supported workflows to run intelligence use cases across environments including SOC, IR, Insider Risk, Fraud, Red Team, and Threat Hunt
Develop and maintain SOAR playbooks for automated threat response and enrichment, leveraging SOAR to optimize intelligence workflows
Orchestrate workflows across security tools to reduce manual analysis and improve response time
Build and maintain integrations between threat intelligence feeds (commercial, open-source, ISACs) and internal security platforms
Integrate and operationalize TIPs such as MISP, OpenCTI ThreatConnect, Anomali, and ThreatQuotient with enterprise security tools
Create pipelines to ingest, normalize, deduplicate, and enrich Indicators of Compromise (IOCs) and threat data
Correlate intelligence with telemetry from SIEM, EDR, NDR, and cloud security tools to improve detection fidelity
Enable automated enrichment of alerts using threat intelligence data within SIEM workflows

Required qualifications

3+ years of experience in a cyber threat intelligence, cyber security engineering, incident response, or malware analysis role with a strong emphasis on tool and technology integration
Proficiency in Python (primary) for automation, API integrations, and data processing
Proficiency in one or more of: Java, JavaScript/Node.js, or Go for service development
Experience with REST APIs, JSON, and STIX/TAXII protocols
Experience with data parsing, transformation, and pipeline development
Experience with scripting in Bash and/or PowerShell
Demonstrated familiarity with Git and CI/CD pipelines
Demonstrated familiarity with OSes and platforms including Linux (Ubuntu, CentOS, RHEL, Kali), AWS, Docker, Windows Server (NT through 2012), Active Directory, and Mac OS X
Experience applying AI within a threat intelligence framework, including LLM, MCP server configuration, RAG, and related processes
Hands-on experience with TIPs such as MISP, OpenCTI, ThreatConnect, and Anomali
Experience integrating multiple intelligence feeds and formats
Solid experience with SIEM platforms: Splunk, Microsoft Sentinel, IBM QRadar, Elastic
Experience building detection rules, correlation searches, and dashboards
Proven understanding of log ingestion, normalization, and enrichment pipelines
Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, Swimlane, and Tines
Development experience with playbooks/runbooks for automated response
Proven knowledge of structured threat data formats: STIX and TAXII

Technologies you may work with

Python, Java, JavaScript/Node.js, Go
REST APIs, JSON, STIX/TAXII
Bash, PowerShell, Git, CI/CD
Linux (Ubuntu, CentOS, RHEL, Kali), AWS, Docker
Windows Server (NT through 2012), Active Directory, Mac OS X
LLMs, MCP server configuration, RAG
MISP, OpenCTI, ThreatConnect, Anomali, Splunk, Microsoft Sentinel, IBM QRadar, Elastic
Cortex XSOAR, Splunk SOAR, Swimlane, Tines
ThreatQuotient, EDR, NDR, IOcs, TIPs, SIEM, SOAR

Benefits

Comprehensive benefits package
Incentive and recognition programs
Equity stock purchase
401k contribution (all benefits are subject to eligibility requirements)

Preferred qualifications

Relevant certifications (examples: GCTI, GCIA, CISSP, Splunk certifications)
Experience in large-scale security operations or SOC environments
Familiarity with MITRE ATT&CK and other intelligence frameworks
Familiarity with data engineering technologies (examples: Kafka, Spark, Elasticsearch)
Experience with cloud platforms (AWS, Azure, GCP) and security integrations
Experience in threat hunting and detection engineering