Principal Threat Hunter, Cyber Security (remote)

$121,000 - $186,230/Yr

Cencora Limited - Washington, DC

Full-time - Senior

Remote - Washington, DC

About the position

The Principal Threat Hunter is a technical leader within the Cencora Security Operations Center, responsible for proactively investigating potential cyber threats using knowledge of adversarial tactics and security controls. This role involves improving detection, response, and security measures based on findings from threat hunting activities.

Responsibilities

• Conduct threat hunting to identify, classify, prioritize, and report on cyber threats following industry best practices.
• Conduct research on emerging security threats and provide correlation and trending of cyber incident activity.
• Craft methodologies for monitoring, detection, and analytics for SIEM and other platforms.
• Provide security gap analysis and effectiveness assessments of security platform technologies such as SIEM, SOAR, XDR, EDR.
• Formulate methodologies to monitor for and respond to security-related events.
• Identify and correlate with other data sources to enhance security event detection, monitoring, and response capabilities.
• Oversee the response to information security incidents, including investigation, countermeasures, and recovery.
• Analyze security incidents for further enhancement of alerting schema.
• Provide security briefings to advise on critical issues that may affect the enterprise.

Requirements

• Exceptional written and verbal communication skills to convey complex technical topics clearly.
• Expert level understanding of security controls including system-level controls, network controls, and security operations across Endpoint, Cloud, SaaS, and Identity.
• Advanced knowledge of Endpoint Detection and Response (EDR) capabilities and multiple EDR products.
• Foundational knowledge of Digital Forensics and Incident Response (DFIR) processes.
• Experience creating SIEM correlation logic, performing data analysis, managing data intake, and conducting security threat analytics on real-time and historical log data.
• Ability to create processes around analyzing and investigating alerts and threats for anomalous, suspicious, or malicious activity.
• Ability to create processes and methodologies to support proactively hunting for potential cyber threats.
• Knowledge of regular expressions and at least one common scripting language (Python, PowerShell, etc.).
• Experience mentoring others as they advance their technical skills.
• Ten (10) or more years of working in the cybersecurity industry (Enterprise level).
• Eight (8) or more years of directly-related or relevant experience, preferably in information security.
• Bachelor's Degree in Computer Science, Information Technology or any other related discipline or equivalent related experience.

Nice-to-haves

• Azure Security Engineer Certification
• Certified Cloud Security Professional (CCSP)
• Certification in Information Security Strategy Management (CISM)
• Certified Information Systems Security Professional (CISSP)
• CompTIA Security + Certification
• Systems Security Certified Practitioner (SSCP)

Benefits

• Paid parental leave
• Caregiver leave
• Health insurance
• Dental insurance
• Flexible spending account
• Adoption assistance
• Parental leave
• Vision insurance