Cyber Threat Hunter (TS- Q Clearance Required, Onsite)

Work You’ll Do

• Conduct proactive threat hunting activities to identify suspicious activity and potential cyber threats, preventing escalation.
• Apply independent critical thinking to analyze threat intelligence data, emerging attack techniques, tactics, and procedures (TTPs) to determine the best response and remediation actions.
• Conduct analysis of log data from various internal data sources (e.g., firewalls, hosts, EDR, IDS/IPS) to identify suspicious activity and assess potential threats impacting the organization.
• Develop and deploy security monitoring content, including dashboards and alerts within the organization's SIEM and other security tools to detect threats, suspicious activities, aiding in incident investigation efforts.
• Regularly review, evaluate, and optimize custom and default detection content to ensure it supports internal and SOC operations effectively.
• Create and maintain technical documents, including, but not limited to, content creation, content/rule review process, queries for disparate log sources, network/security visibility issues, detection gaps, and monitoring strategies.
• Identify areas for improvement in security monitoring and propose enhancements to strengthen the organization's detection and response capabilities.
• Mentor and guide fellow security team members, assisting with project execution and promoting skill development in tactical security practices.
• Directly interface, manage, and mentor the SOC.
• Developing strategies to handle security incidents and coordinating responses to security breaches.

The Team

Deloitte’s Government and Public Services (GPS) practice – our people, ideas, technology, and outcomes—are designed for impact. Serving federal, state, & local government clients as well as public higher education institutions, our team of professionals brings fresh perspective to help clients anticipate disruption, reimagine the possible, and fulfill their mission promise.

Our Cyber Defense & Resilience offering assists clients in defending against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence. Helps manage and protect dynamic attack surfaces and provides rapid crisis and cyber incident response, ensuring clients can be ready for, respond to, and recover from business disruptions.

Qualifications 

Required: 

• Bachelor’s degree required. 
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.
• Active TS – Q clearance required.
• Must be local to Las Vegas, NV and have the ability to be onsite up to 5 days a week.
• Experience in monitoring and analyzing logs and alerts from a variety of different technologies and sources to include but not limited to Network/Host, EDR, Firewall, IDS/IPS, Cloud (IaaS, PaaS, SaaS).
• Experience in leading incident response engagements.
• Experience in developing detection content using various data sources and query languages.

Preferred Qualifications:

• Knowledge of content creation concepts, content development management, content testing, implementation, and threat analysis of complex events
• Knowledge of security standards and frameworks (e.g., MITRE ATT&CK)
• Experience with security tools related to EDR, Firewalls, IPS/IDS, DLP, Forensic/Malware Analysis, SIEM, and Cloud.
• Familiarity with cloud platforms (AWS, GCP, Azure)
• Proven experience with GenAI and LLM.
• Stay up to date with the latest research and advancements in High-Tech, ML/AI domain.
• Strong communication and Analytical skills.
• Ability to work in teams in a diverse, multi-stakeholder environment comprising of Business and Technology teams.
• Experience and desire to work in