Senior Security Engineer

Job Description - Security Operations Engineer 2 (Threat Hunter)

Job Title

Security Operations Engineer 2

Role Summary:

The Threat Hunter is tasked with the proactive identification, investigation, and mitigation of advanced cyber threats within PGC enterprise environments. The candidate will utilize threat intelligence, hypothesis-driven hunting, behavior analytics, and advanced detection techniques to uncover malicious activities not addressed by traditional security controls.

Key Responsibilities:

• Conduct proactive threat hunting across endpoints, network, cloud, identity, and email environments.
• Develop and implement threat hunting hypotheses based on emerging threats and adversary tactics, techniques, and procedures (TTPs).
• Analyze security telemetry using platforms such as SIEM, EDR/XDR, Cloud Security, Data Security, EASM, email security gateways, Threat Intelligence, Dark Web monitoring, identity management, SOAR, Case Management, and various log sources.
• Investigating Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
• Align threat hunting and investigation findings with the MITRE ATT&CK framework.
• Create and refine threat detection rules, use cases, and behavioral analytics based on threat hunting outcomes and investigations to enhance security monitoring coverage.
• Conduct digital forensic and incident analysis to determine the scope and impact of attacks.
• Produce technical reports and executive summaries detailing threat hunting activities.
• Perform triage, investigation, and response to security incidents.

Required Skills/Qualifications:

• Comprehensive understanding of cyber-attack lifecycles and adversary behavior.
• Expertise in the MITRE ATT&CK framework.
• Experience with SIEM and SOAR platforms, such as CrowdStrike Falcon Next-Gen SIEM and Palo Alto Network Cortex XSOAR.
• Hands-on experience with EDR/XDR solutions, including Microsoft Defender and CrowdStrike Falcon.
• In-depth knowledge of Windows, Linux, Active Directory/Entra ID, Azure Cloud Platform, and networking protocols (DNS, HTTP(s), SMTP, LDAP, TCP/IP).
• Proficiency in Kusto Query Language (KQL), SQL, and scripting languages such as Python and PowerShell.
• Understanding of malware analysis and digital forensics.
• Strong analytical, communication, and documentation skills.
• SOAR Playbook Development

Preferred Qualifications:

• 3-6 years of experience in cybersecurity, with at least 3 years in threat hunting.
• Relevant certifications such as GIAC Certified Threat Hunter (GCTI/GCTH), GIAC Certified Forensic Analyst (GCFA/GNFA), MITRE ATT&CK Defender (MAD - All modules) or equivalent certifications.