Threat Hunt Senior Associate

RESPONSIBILITIES

Kforce has a client in need of a Threat Hunt Senior Associate in Tampa, FL.

Responsibilities

• Conduct hypothesis-driven threat hunts aligned with MITRE ATT&CK techniques across endpoint, identity, cloud, and network environments
• Analyze EDR/XDR, SIEM, identity, cloud, and Kubernetes telemetry to identify and investigate suspicious activity
• Investigate credential abuse, persistence, lateral movement, defense evasion, command-and-control activity, and cloud-based threats
• Build investigation timelines, determine scope and impact, perform root-cause analysis, and recommend containment actions
• Document hunt hypotheses, queries, evidence, findings, confidence levels, and follow-up activities to ensure repeatable investigations
• Convert hunt findings into improved detections, SIEM rules, monitoring controls, and telemetry enhancements
• Develop and tune detection logic using technologies such as Sigma, YARA, SIEM analytics, and EDR controls
• Partner with Red/Purple Teams to validate detection coverage through adversary simulations and controlled testing
• Support security incidents with rapid scoping, related-activity searches, containment analysis, and post-incident improvements
• Collaborate with automation teams to streamline recurring enrichment, investigation, and triage processes

REQUIREMENTS:

• 3+ years of experience in Threat Hunting, Detection Engineering, Incident Response, SOC investigations, or similar cybersecurity functions
• Hands-on experience conducting and documenting hypothesis-based threat hunts
• Strong understanding of MITRE ATT&CK and common adversary tactics, techniques, and procedures
• Experience analyzing security telemetry across endpoint, identity, network, and cloud environments
• Proficiency with at least one security query language or platform, such as KQL, Splunk SPL, Elastic/Kibana, or Google SecOps/Chronicle
• Experience with SIEM and EDR/XDR platforms and security detection development
• Knowledge of credential attacks, PowerShell/LOLBins, persistence techniques, command-and-control activity, and network anomalies
• Familiarity with cloud and container security, including suspicious API activity, identity abuse, and Kubernetes threats
• Experience developing or tuning detections using Sigma, YARA, SIEM rules, or EDR-based controls
• Strong investigative, analytical, documentation, and communication skills

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.
We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law. This job is not eligible for bonuses, incentives or commissions. Kforce is an Equal Opportunity/Affirmative Action Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status. By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

You will always have the right to cease communicating via text by using key words such as STOP.