Cyber Threat Hunter

- Create Threat Models to better understand the DHS IT Enterprise, identify defensive gaps, and prioritize mitigations. - Author, update, and maintain SOPs, playbooks, and work instructions. - Utilize Threat Intelligence and Threat Models to create threat hypotheses and plan and scope Threat Hunt Missions to verify those hypotheses. - Proactively and iteratively search through systems and networks to detect advanced threats. - Analyze host, network, and application logs, in addition to malware and code. - Prepare and report risk analysis and threat findings to appropriate stakeholders. - Lead cyber threat hunt missions with minimal supervision or guidance and recommend courses of action, best practices, and mitigating actions to improve security practices. - Write clearly and concisely regarding technical and non-technical products based on threat hunt findings and outcomes. - Brief senior-level leaders and executives on technical topics while translating them into non-technical terms for decision-makers. - Develop scripts to support cyber threat detection, outputting results in multiple formats. - Conduct cyber threat analysis, identifying mitigation and/or remediation courses of action and trending cyber threat metrics for leadership situational awareness. - Maintain a comprehensive understanding of the cyber threat landscape, including identifying and analyzing cyber threats, actors, and activities to enhance the organization’s cybersecurity posture. - Create and assist with the development of new security content resulting from hunt missions, including signatures, alerts, workflows, and automation. - Coordinate with different teams to improve threat detection, response, and overall security posture of the Enterprise. - Identify, track, and investigate high-priority threat campaigns and malicious actors. - Maintain the daily battle rhythm and schedule of threat hunts with an emphasis on attention to detail and technical analysis. - Review current and emerging cyber threat intelligence to maintain situational awareness. - Create daily, weekly, and monthly reporting data and collect, aggregate, and report on metrics derived from threat hunts.