Cyber Threat Hunter

The College Board

. Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry .

Posted 10/20/2026full-timeRemote • United StatesJunior💰 $116,000 - $125,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in hypothesis-driven threat hunting, incident response, and detection engineering within AWS environments. Proficient in developing and tuning detections, conducting log analysis, and collaborating across teams to enhance security posture.

Highest-signal resume keywords

Threat HuntingIncident ResponseAWS Cloud SecurityDetection EngineeringLog Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat HuntingDetection EngineeringLog AnalysisAWS Cloud SecurityQuery WritingEDRSIEMTuning DetectionsAutomation ScriptingMITRE ATT&CK

Soft Skills

Strong Communication SkillsCuriosityCollaborative ApproachLearner's MindsetEmpathy

Tools & Technologies

AWS CloudTrailIAMS3VPC Flow LogsCloudWatchGuardDutyEDRSIEMAI ToolsAutomation Tools

Certifications & Qualifications

GCIAGCIHGNFAAWS Security SpecialtySecurity+

Industry Keywords

Cyber DefenseSOC AnalysisIncident ResponsePurple TeamForensicMDRGRCContainersKubernetesCI/CD Pipelines

Tech Stack

Tools & technologies

AWSCloudKubernetesPython

About the role

Key responsibilities & impact

Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry
Document hunt findings and recommended control or detection improvements
Build, tune, and maintain detections for IAM misuse, persistence, privilege escalation, and data access or exfiltration
Reduce alert noise through tuning, baselining, and enrichment
Map detections and hunts to MITRE ATT&CK techniques
Support security incident investigation and containment through triage, log analysis, impact scoping, and documentation
Develop and refine incident response playbooks
Produce after-action reports covering root cause, control gaps, and remediation steps
Participate in tabletop, fire drill, and purple team exercises
Partner with offensive testing, engineering, architecture, product security, GRC, and product teams
Improve logging, telemetry coverage, detections, and hardened configurations
Develop lightweight automation and scripts for investigation, enrichment, and reporting
Use LLMs and AI tools to accelerate enrichment, automation, and tool development while validating outputs
Maintain detection logic, hunt results, and response procedures
Share threat insights and lessons learned through briefings or written updates

Requirements

What you’ll need

1 to 3 years of experience in cyber defense, such as threat hunting, detection engineering, SOC analysis, or incident response, in enterprise environments
Recent graduates with a year or more of relevant hands-on experience are encouraged to apply
Clear understanding of proactive, hypothesis-driven threat hunting and its distinction from incident response
Strong foundations in endpoint and operating system behavior, including process trees and anomalous activity
Foundational to moderate AWS cloud security experience, including CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch logs, and GuardDuty
Hands-on experience writing queries and working with EDR, SIEM, and authentication logs
Experience tuning detections to improve signal-to-noise
Experience supporting incident response, including triage, log analysis, scoping, and documentation
Strong written and verbal communication skills
Experience partnering across engineering, architecture, and development teams
Authorization to work in the United States
Curiosity and willingness to adopt emerging AI-driven solutions and digital tools
Learner's mindset and commitment to growth
Collaborative and empathetic approach
Nice to have: relevant certifications such as GCIA, GCIH, GNFA, AWS Security Specialty, or Security+
Nice to have: familiarity with containers, Kubernetes, serverless, CI/CD pipelines, and identity-based cloud attacks
Nice to have: Python, PowerShell, or Bash scripting skills
Nice to have: familiarity with LLMs and AI security tooling
Nice to have: purple team, MITRE ATT&CK, investigative, forensic, MDR, SOC, or GRC experience

Benefits

Comp & perks

Fully remote work option
Hybrid option for candidates living near College Board offices (Tuesday and Wednesday in office)
Comprehensive compensation and benefits package
Compensation adjusted by location
Transparent conversations about compensation and benefits
Meaningful career and supportive team
Self-sustaining nonprofit work environment