below marketmost similar roles pay hereabove market
This role pays less than
86%
of similar roles. Most pay
$122,275–$184,900
— the blue band above.
At the midpoint, this role pays about
$114k
versus about
$154k
for comparable roles.
Based on 240 similar postings.
Employer
About Booz Allen Hamilton
Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting
Booz Allen Hamilton currently has
1662 open roles
on FindRole.
Listed pay typically runs
$86,800–$198,000
across 904 roles with salary data.
The Cyber Threat Hunter joins the security team to develop and execute hypothesis-driven hunts designed to identify sophisticated adversary activity that evades automated detections. This role involves translating cyber threat intelligence and adversary tradecraft into actionable hunt hypotheses to uncover malicious behaviors across endpoint, identity, network, and cloud environments. You will query and correlate large-scale security telemetry using EDR, XDR, and SIEM platforms, including technologies like SentinelOne, CrowdStrike Falcon, Palo Alto Cortex XDR, and Microsoft Defender for Endpoint. Key responsibilities include mapping tactics to the MITRE ATT&CK framework, developing reusable hunt methodologies, and reconstructing attacker activity using digital forensic and incident response processes. You will analyze telemetry for anomalies, establish baselines, and escalate validated findings to improve detection opportunities and address visibility gaps.
Develop and execute proactive, hypothesis-driven threat hunts to identify sophisticated adversary activity.
Translate cyber threat intelligence and adversary tradecraft into actionable hunt hypotheses.
Query and correlate large-scale security telemetry across EDR, XDR, and SIEM platforms.
Map adversary tactics and techniques to the MITRE ATT&CK framework to identify coverage gaps.
Reconstruct attacker behavior by pivoting between endpoint, network, identity, and cloud datasets.
Develop and maintain reusable hunt methodologies, queries, playbooks, and analytical techniques.
Escalate validated findings into the incident response process when active compromise is identified.
Translate lessons learned from investigations into new hunt hypotheses and improved detection opportunities.
What we're looking for
High school diploma or GED.
3+ years of experience in threat hunting, incident response, digital forensics, detection engineering, or advanced security analysis.
Experience conducting proactive threat hunts and querying large volumes of security telemetry across EDR/XDR and SIEM platforms.
Experience with one or more major EDR/XDR technologies such as SentinelOne, CrowdStrike Falcon, Palo Alto Cortex XDR, or Microsoft Defender for Endpoint.
Knowledge of MITRE ATT&CK to translate adversary techniques into hunt hypotheses and identify necessary telemetry.
Knowledge of endpoint telemetry, including processes, command-line execution, persistence mechanisms, and operating system artifacts.
Knowledge of network telemetry, including DNS, HTTP/S, proxy, firewall, and connection data.
Ability to correlate activity across endpoint, network, identity, and cloud sources to reconstruct adversary behavior.