Threat Hunting Analyst (Xico)

Meet the Team

The Computer Security Incident Response Team (CSIRT) serves as the frontline defense for our global infrastructure, protecting the integrity of our systems and data. We operate as a collaborative, fast-paced unit of analysts and investigators dedicated to identifying and neutralizing complex cyber threats. By integrating proactive threat hunting with rapid incident response, we ensure the safety of our integral enterprise. Our team values diverse perspectives, continuous learning, and a culture of accountability.

Your Impact

As a Threat Hunting Analyst, you will investigate security alerts and analyze telemetry across endpoint, network, and cloud platforms to identify and mitigate malicious activity. You will coordinate with cross-functional teams to ensure rapid incident resolution and minimize business impact. You will develop and refine standard operating procedures and playbooks to improve the efficiency of our detection and response capabilities. By participating in intelligence-driven threat hunting, you will proactively identify emerging attacker tactics to strengthen our overall security posture. This role is essential for maintaining our operational resilience and protecting our global environment from evolving threats. You will also perform the following:

• Investigate security alerts, suspicious activity, phishing reports, and potential security incidents across multiple technologies and platforms.
• Document investigations, analysis, decisions, and actions clearly and thoroughly.
• Coordinate incidents with internal teams, including engineering, infrastructure, identity, legal, HR, and business partners when appropriate.
• Support operational improvement initiatives, including detection tuning, workflow improvements, automation opportunities, and process documentation.
• Assist with development and refinement of standard operating procedures, playbooks, and analyst guidance.
• Collaborate with teammates globally to improve investigative consistency, response efficiency, and customer experience.
• Participate in proactive threat hunting, intelligence-driven investigations, and identification of emerging attacker tactics and techniques.
• Contribute to continuous improvement efforts by identifying gaps, recommending solutions, and helping operationalize new capabilities.
• Communicate efficiently with technical and non-technical audiences during investigations and incident response activities.

Minimum Qualifications

• Bachelor's degree or equivalent experience in Computer Science, Cybersecurity, or a related technical field.
• 3+ years of professional experience in cybersecurity operations, incident response, or threat detection.
• Demonstrated experience investigating security alerts using telemetry from endpoints, networks, or cloud platforms.
• Experience leading security incidents within an enterprise-level case management or ticketing system.
• Technical proficiency with SIEM, EDR, or network security monitoring tools in a production environment.

Preferred Qualifications

• Experience with security monitoring and analysis platforms such as Splunk or Microsoft Defender.
• Demonstrated understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT.
• Proficiency in scripting or automation using Python, PowerShell, or SQL to improve operational workflows.
• Knowledge of malware analysis, identity-based attack vectors, insider threats, and endpoint investigation techniques.
• Experience with cloud environments including Amazon Web Services, Microsoft Azure, and Google Cloud.