below marketmost similar roles pay hereabove market
This role pays less than
86%
of similar roles. Most pay
$122,275–$184,900
— the blue band above.
At the midpoint, this role pays about
$114k
versus about
$154k
for comparable roles.
Based on 240 similar postings.
Employer
About Booz Allen Hamilton
Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting
Booz Allen Hamilton currently has
1662 open roles
on FindRole.
Listed pay typically runs
$86,800–$198,000
across 904 roles with salary data.
The Cyber Threat Hunter joins the security team to develop and execute hypothesis-driven hunts designed to identify sophisticated adversary activity that evades automated detections. This role involves translating cyber threat intelligence and adversary tradecraft into actionable hunt hypotheses to uncover malicious behaviors across endpoint, identity, network, and cloud environments. You will query large-scale security telemetry, correlate data from multiple sources, and reconstruct attacker behavior using the MITRE ATT&CK framework. Key responsibilities include developing reusable hunt methodologies, playbooks, and complex queries across EDR, XDR, and SIEM platforms. Required skills include proficiency with technologies like SentinelOne, CrowdStrike Falcon, or Microsoft Defender for Endpoint, along with knowledge of KQL, Python, and PowerShell. You will apply digital forensic and incident response lifecycle knowledge to identify persistence, lateral movement, and exfiltration.
Develop and execute proactive, hypothesis-driven threat hunts to identify sophisticated adversary activity.
Translate cyber threat intelligence and adversary tradecraft into actionable hunt hypotheses.
Query and correlate large-scale security telemetry across EDR, XDR, and SIEM platforms.
Map adversary tactics and techniques to the MITRE ATT&CK framework to identify coverage gaps.
Reconstruct attacker behavior by pivoting between endpoint, network, identity, and cloud datasets.
Develop and maintain reusable hunt methodologies, queries, playbooks, and analytical techniques.
Escalate validated findings into the incident response process when active compromise is identified.
Translate lessons learned from investigations into new hunt hypotheses and improved detection opportunities.
What we're looking for
High school diploma or GED.
3+ years of experience in threat hunting, incident response, digital forensics, detection engineering, or advanced security analysis.
Experience conducting proactive threat hunts and querying large volumes of security telemetry across EDR/XDR and SIEM platforms.
Experience with one or more major EDR/XDR technologies such as SentinelOne, CrowdStrike Falcon, Palo Alto Cortex XDR, or Microsoft Defender for Endpoint.
Knowledge of MITRE ATT&CK to translate adversary techniques into hunt hypotheses and identify necessary telemetry.
Knowledge of endpoint telemetry, including processes, command-line execution, persistence mechanisms, and operating system artifacts.
Knowledge of network telemetry, including DNS, HTTP/S, proxy, firewall, and connection data.
Ability to correlate activity across endpoint, network, identity, and cloud sources to reconstruct adversary behavior.
Experience conducting digital forensic or incident response investigations (preferred).
Experience working with cyber threat intelligence and translating reporting into actionable hunts (preferred).
Experience developing behavior-based detections from successful threat hunts (preferred).
Strong understanding of identity and authentication telemetry (preferred).
Experience with Microsoft Sentinel or comparable enterprise SIEM platforms (preferred).
Experience with multiple query languages such as KQL and vendor-specific languages (preferred).
Experience scripting or automating security analysis using Python, PowerShell, or similar technologies (preferred).
Knowledge of cloud telemetry and common attacker techniques affecting cloud environments (preferred).
Possession of strong analytical and verbal and written communication skills (preferred).
Cybersecurity certifications such as GCFA, GNFA, GCIH, GCIA, GCTI, GDAT, or comparable certifications (preferred).