RemoteLeaf Logo
Log in Sign up

Threat Hunter/Purple Team Operator

5 hours, 37 minutes ago
United States
Full-time
Mid Level
Security Analyst
Cybersecurity
Carbon Black Cybersecurity Elasticsearch PowerShell Python SIEM Splunk
Apply Now
SIXGEN

SIXGEN

SIXGEN is a leading cybersecurity company based in the United States, specializing in assessing devices, networks, and critical infrastructure for vulnerabilities. They offer a wide range of cybersecurity services, including penetration tests, CMMC com...

Professional Services
51-250
Founded 2014
View All Jobs

Description

  • Conduct hypothesis-driven and intelligence-led hunts across endpoint, network, cloud, and identity telemetry.
  • Analyze logs, alerts, and historical data for indicators of compromise, anomalous behavior, and MITRE ATT&CK-mapped adversary techniques.
  • Document hunt methodology, coverage, findings, detection recommendations, and suspected compromises; escalate active threats immediately.
  • Deliver threat-hunt summaries and determine whether customer environments are clear before red team assessments.
  • Partner with blue teams to detect, tune, and validate controls against red team techniques in real time.
  • Brief technical and non-technical stakeholders on hunt results and purple-team outcomes.
  • Serve as a Trusted Agent during red team assessments while maintaining confidentiality and operational security.
  • Translate adversary tradecraft into defensive guidance and detection improvements.

Requirements

  • 3–5+ years of experience in threat hunting, SOC/detection engineering, incident response, or a related defensive security role.
  • Hands-on experience with a major SIEM and EDR platform.
  • Experience with SIEM tools such as Splunk, Microsoft Sentinel, or Elastic.
  • Experience with EDR/XDR tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, or Carbon Black.
  • Working knowledge of MITRE ATT&CK and mapping observed activity to adversary TTPs.
  • Understanding of red team methodology, common adversary tradecraft, and C2 traffic patterns.
  • Experience with network detection, cloud and identity telemetry, and tools such as Zeek, Suricata, Azure AD/Entra ID, AWS CloudTrail, or Microsoft 365.
  • Ability to use KQL, SPL, Python, PowerShell, or similar query and scripting languages.
  • Strong written and verbal communication skills, including customer-facing reporting and clearance determinations.
  • U.S. citizenship and eligibility for a government security clearance; active Top Secret with SCI eligibility required. Preferred certifications include GCFA, GCIH, GNFA, GCTI, or CySA+.

Benefits

  • Competitive compensation based on experience, expertise, responsibilities, and clearance status.
  • Employer-paid medical, dental, and vision insurance for employees and families.
  • Employer-paid short- and long-term disability, life, and AD&D insurance.
  • 401(k) plan with a 4% employer contribution.
  • Professional-development reimbursement for training, certifications, and education.
  • Flexible remote-work policies, paid time off, and holiday schedule.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

PDI Technologies,

Manager, Threat Intelligence

PDI Technologies, 1K-5K Gas Utilities

PDI Technologies is seeking a Threat Intelligence, Threat Hunting, and Detection Engineering leader to build and lead a SOC program that protects more than 12,000 convenience retail, petroleum, hospitality, and automotive customers.

United States Full-time Lead Security Analyst
AWS Azure Cybersecurity Python SIEM Splunk
1 day, 5 hours ago
JustMarkets

Incident Response & DFIR Lead

JustMarkets 1-10 Capital Markets

Lead incident response and digital forensics investigations for a fintech company, coordinating containment, recovery, evidence preservation, and improvements to cyber defense capabilities.

Europe Full-time Lead Security Analyst
Active Directory AWS Linux Network Security PowerShell Python SIEM
1 week, 3 days ago
RecargaPay

Cyber Security Specialist

RecargaPay 251-1K Capital Markets

RecargaPay is hiring a Cyber Security Specialist to join its remote CSIRT team and lead detection, response, containment, and automation for security incidents across its cloud-native payments platform.

Brazil Full-time Senior Security Analyst
AWS Bash CrowdStrike Cybersecurity Elasticsearch Kibana Linux Python
1 week, 3 days ago
CareDx

IT SOX Admin

CareDx 251-1K Pharmaceuticals

CareDx is seeking an IT compliance and systems documentation professional to strengthen system governance, access controls, audit readiness, and operational integrity in its regulated precision-medicine diagnostics environment.

United States Full-time Mid Level Security Analyst
$80k-$100k
Active Directory Git NetSuite
2 weeks, 2 days ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers