Threat Hunter - Incident Response

Zachary Piper Solutions is currently seeking an Incident Response - Threat Hunter to join our Cyber Threat Fusion Center (CFTC) team in Lanham, MD. This is an ON-SITE position critical in safeguarding our network and assets, ensuring robust security measures and procedures are maintained. This Threat Hunter will play a pivotal role in incident response, threat hunting, and security analysis within a high-stakes environment protecting substantial assets for the IRS.

Key Responsibilities:

• Lead complex security incident responses, from post-breach analysis to threat actor identification, leveraging netflow, PCAP analysis, and security event logs to identify and mitigate lateral movements and escalations.
• Utilize a deep understanding of endpoint analysis, leveraging tools and knowledge in PowerShell, and cloud security tools (e.g., Defender, AWS Security tools) to strengthen our security posture.
• Demonstrate proficiency in writing and understanding Snort (or Defender) rules, with a strong capability in utilizing SIEM tools, specifically Splunk, for detailed incident analysis and resolution.
• Serve as an escalation point for security incidents, minimizing reliance on external escalation and providing comprehensive solutions.
• Engage in proactive threat hunting, leveraging network data, netflows, and PCAPs for detailed analysis, and employing log information analysis (sysmon, event ID, registry rights) to preemptively identify and neutralize threats.
  
  

Requirements:

• 5 years of experience in Cyber Security, particularly within SOC/CIRT environments.
• Proven track record of handling full-cycle incident response and advanced threat analysis.
• Strong familiarity with Splunk Processing Language (SPL), capable of conducting sophisticated queries and analyses.
• Knowledge of attacker methodologies, including APT identification, indicators of compromise, and persistence mechanisms.
• Proficiency in network fundamentals and packet capture (PCAP) analysis tools such as Wireshark.
• Solid experience with scripting languages, preferably PowerShell, for automation and log analysis.
• Ability to obtain an IRS Public Trust clearance.
  
  

Compensation to include:

• Salary Range: $90,000 – $125,000 **depending on experience and LCAT qualification**
• Full Benefits: Medical, Dental, Vision, 401K, PTO, Sick Leave if Required by Law
  
  

This job opens for applications on 3/21/2025. Applications for this job will be accepted for at least 30 days from the posting date

Keywords: Cybersecurity, Incident Response, Splunk, Splunk SPL, SPL, Packet Capture, Wireshark, Wire Shark, Network Forensics, Threat Hunting, Intrusion Detection, Log Analysis, SIEM (Security Information and Event Management), Malware Analysis, Network Traffic Analysis, Forensic Analysis, Threat Intelligence, Security Operations Center (SOC), Vulnerability Assessment, IDS/IPS (Intrusion Detection System/Intrusion Prevention System), PCAP Analysis, Network Security, Anomaly Detection, Endpoint Detection and Response (EDR), Cyber Threats, Cyber Attack, Threat Mitigation, Forensic Investigation, Digital Forensics, Security Incident, Data Breach, Advanced Persistent Threat (APT), Insider Threat, Security Policies, Compliance Management, Security Architecture, Security Operations, Incident Handling, Network Security Monitoring (NSM), Security Awareness Training, Security Risk Assessment, Threat Intelligence Platforms (TIP), Security Analytics, Insider Threat Detection