Signals and Defense Engineer, Mid

What you'll do

• Investigate security alerts and suspicious activity across endpoint, network, identity, cloud, and infrastructure environments.
• Perform incident triage to determine the scope, severity, impact, and root cause of security events.
• Support containment, eradication, and recovery activities during active cybersecurity incidents.
• Conduct proactive threat hunts using threat intelligence and adversary behaviors to identify detection gaps.
• Develop and execute threat hunting hypotheses aligned to the MITRE ATT&CK framework.
• Analyze large volumes of security telemetry to identify patterns, anomalies, and indicators of compromise.
• Translate investigation findings into actionable detection logic and new alerts for SOC monitoring teams.
• Document investigation findings, timelines, threat hunting methodologies, and recommended remediation actions.

What we're looking for

• U.S. citizenship is required.
• High school diploma or GED is required.
• 1+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations.
• Experience conducting hypothesis-driven threat hunts to identify suspicious or malicious activity not detected through existing security controls.
• Experience with adversary tactics, techniques, and procedures, including practical application of the MITRE ATT&CK framework.
• Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise.
• Experience using SIEM, EDR/XDR, or security data platforms to query, correlate, and analyze large volumes of security telemetry.
• Experience using AI, machine learning, automation, or agentic security technologies to assist with security investigation, enrichment, correlation, or threat hunting.
• Experience with cloud security investigations across environments such as AWS, Azure, or GCP.
• Knowledge of Windows and Linux environments, including analysis of system logs, processes, command-line activity, and forensic artifacts.
• Experience with scripting or automation using technologies such as Python, PowerShell, Bash, or SQL (preferred).
• Experience with cloud incident response involving containers, Kubernetes, Docker, or serverless workloads (preferred).
• Experience performing network analysis using packet captures, Zeek, DNS telemetry, or proxy data (preferred).
• Experience with malware analysis, digital forensics, or memory and disk artifact analysis (preferred).
• Bachelor’s degree in Cybersecurity, CS, Information Systems, Engineering, or a related field (preferred).