Threat Hunter

<p><span style="font-weight: bold">Who we are:</span></p> <p><br></p> <p>ShorePoint is a fast-growing, industry recognized and award-winning cybersecurity services firm with a focus on high-profile, high-threat, private and public-sector customers who demand experience and proven security models to protect their data. ShorePoint subscribes to a “work hard, play hard” mentality and celebrates individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers. We are equally passionate about an environment that supports creativity, accountability, diversity, inclusion and a focus on giving back to our community. </p> <p><br></p> <p><span style="font-weight: bold">The Perks:</span></p> <p><br></p> <p>As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individuals technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, including major carriers for health care providers. Highlighted benefits offered: 144 hours of PTO, 11 holidays, 85% of insurance premium covered, 401k, continued education, certifications maintenance and reimbursement and more.</p> <p><br></p> <p><span style="font-weight: bold">Who we’re looking for:</span></p> <p><br></p> <p>We are seeking a <span style="font-weight: bold">Threat Hunter</span> to support and enhance our 24/7 Security Operations Center. This role combines advanced threat detection, incident investigation and threat hunting with hands-on development of SIEM use cases, automation and analytics to identify and respond to sophisticated threats, including lateral movement. The ideal <span style="font-weight: bold">Threat Hunter</span> brings strong investigative expertise and a builder mindset to continuously improve detection capabilities and strengthen overall SOC effectiveness. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.</p> <p><br></p> <p><span style="font-weight: bold">What you’ll be doing: </span></p> <p><br></p> <ul> <li>Provide first-line SOC support, including alert monitoring, triage, routing, escalation and response across 24x7x365 operations.</li> <li>Monitor, analyze and investigate security events, network traffic and host-based detections, distinguishing malicious activity from false positives.</li> <li>Perform proactive and creative threat hunting and anomaly detection across SIEM and security tools, identifying patterns, lateral movement and emerging threats.</li> <li>Conduct incident investigation, Cyber Threat Assessment and Remediation Analysis, including processing and correlating incident indicators with threat intelligence.</li> <li>Tune and develop SIEM correlation rules and detection logic and rapidly build detection use cases in collaboration with incident response (IR) teams.</li> <li>Develop and maintain scripts and tools (Python, Bash) to automate SOC and IR functions, including Indicator of compromise (IoC) ingestion, log processing and SIEM integrations via APIs.</li> <li>Research, develop and maintain dashboards, visualizations and analytics to support detection, reporting and SOC performance monitoring.</li> <li>Produce, review and maintain documentation and reporting, including cybersecurity briefings, metrics, incident reports and deliverables for stakeholders at all levels, ensuring alignment with editorial standards and government specifications.</li> <li>Support threat intelligence operations, including reviewing and actioning IoCs and translating intelligence into actionable detections.</li> <li>Coordinate with internal teams and stakeholders to support engagements such as Insider Threat, Rule of Engagement (ROE), threat hunting, testing activities and after-action reporting.</li> <li>Support SOC operations processes, including ticket tracking, customer security assessments, ad hoc investigations, tabletop exercises and lessons learned activities.</li> <li>Contribute to continuous SOC improvement by enhancing detection capabilities, processes, communication and overall operational effectiveness; participate in on-call rotation.<br></li> </ul> <p><br></p> <p><span style="font-weight: bold">What you need to know: </span><br></p> <p><br></p> <ul> <li>Deep understanding of cyber threat TTPs, threat hunting methodologies and application of the MITRE ATT&CK framework.</li> <li>Experience supporting 24x7x365 SOC operations, including alert monitoring, triage, analysis, response and review/action of threat intelligence and reported incidents.</li> <li>Ability to manage multiple alerts and tickets in parallel, perform end-to-end triage through resolution and appropriately prioritize response actions including coordination with end-users.</li> <li>Strong experience analyzing and correlating security events across multi-source ecosystem, including endpoint, network, email security tools, SIEM platforms and federal threat intelligence (e.g., CISA).</li> <li>Demonstrated proficiency with enterprise security tools and platforms, including but not limited to FireEye, Elastic, Sourcefire, Malwarebytes, Carbon Black/Bit9, Splunk, Prisma Cloud, Cisco IronPort, Bluecoat, Palo Alto, Cylance and OSSEC.</li> <li>Hands-on experience with enterprise SIEM or security analytics platforms (e.g., Elastic Stack, Splunk), including log analysis, event correlation and detection support.</li> <li>Experience with malware analysis and understanding of attack vectors involving malware, data exposure, phishing and social engineering techniques.</li> <li>Experience developing and maintaining SOPs, performing event timeline analysis and investigating logs across Windows/Linux environments and network security devices.</li> </ul> <p><br></p> <p><span style="font-weight: bold">Must have’s: </span></p> <p><br></p> <ul> <li>5+ years of technical experience.</li> <li>Ability to support working hours: 8:45 AM - 5:15 PM Eastern Time</li> <li>Ability to participate in a rotating SOC on-call; rotation is based on number of team members.</li> <li>Demonstrated proficiencies with one or more toolsets such as Bit9/CarbonBlack, CrowdStrike, FireEye ETP, Elastic Kibana.</li> <li>Solid understanding and experience analyzing security events generated from security tools and devices such as: Carbon Black, CrowdStrike, FireEye, Palo Alto, Cylance and OSSEC.</li> </ul> <p><br></p> <p><span style="font-weight: bold">Beneficial to have:</span></p> <p><br></p> <ul> <li>Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Mathematics, Engineering or a related field.</li> <li>One or more of the following certifications: GIAC (GCIH, GCFE, GCFA, GREM, GNFA, GCTI, GPEN, GWAPT), CEPT, CASS, CWAPT or CREA.<br></li> </ul> <p><br></p> <p><span style="font-weight: bold">Where it’s done: </span><br></p> <p><br></p> <ul> <li>Remote (Herndon, VA)</li> </ul><br><hr><div class="fabric-5qovnk-root MuiBox-root css-witlqh" data-fabric-component="Flex"><div class="fabric-5qovnk-root MuiBox-root css-1phs5iq" data-fabric-component="Flex"><div class="fabric-2lfz5e-root MuiBox-root css-jipda8" data-fabric-component="LayoutBox"><p class="fabric-v3bc9l-root" data-fabric-component="BodyText">Location</p></div><div class="fabric-15808a6-root MuiBox-root css-4cxybv" data-fabric-component="LayoutBox"><p class="fabric-958q8r-root" data-fabric-component="BodyText">Herndond, Virginia (Remote)</p></div><hr class="MuiDivider-root fabric-jcid1o-root MuiDivider-fullWidth MuiBox-root css-40h3v3" data-fabric-component="Divider"></div><div class="fabric-5qovnk-root MuiBox-root css-1phs5iq" data-fabric-component="Flex"><div class="fabric-2lfz5e-root MuiBox-root css-jipda8" data-fabric-component="LayoutBox"><p class="fabric-v3bc9l-root" data-fabric-component="BodyText">Department</p></div><div class="fabric-15808a6-root MuiBox-root css-4cxybv" data-fabric-component="LayoutBox"><p class="fabric-958q8r-root" data-fabric-component="BodyText">Staff</p></div><hr class="MuiDivider-root fabric-jcid1o-root MuiDivider-fullWidth MuiBox-root css-40h3v3" data-fabric-component="Divider"></div><div class="fabric-5qovnk-root MuiBox-root css-1phs5iq" data-fabric-component="Flex"><div class="fabric-2lfz5e-root MuiBox-root css-jipda8" data-fabric-component="LayoutBox"><p class="fabric-v3bc9l-root" data-fabric-component="BodyText">Employment Type</p></div><div class="fabric-15808a6-root MuiBox-root css-4cxybv" data-fabric-component="LayoutBox"><p class="fabric-958q8r-root" data-fabric-component="BodyText">Full-Time</p></div><hr class="MuiDivider-root fabric-jcid1o-root MuiDivider-fullWidth MuiBox-root css-40h3v3" data-fabric-component="Divider"></div><div class="fabric-5qovnk-root MuiBox-root css-1phs5iq" data-fabric-component="Flex"><div class="fabric-2lfz5e-root MuiBox-root css-jipda8" data-fabric-component="LayoutBox"><p class="fabric-v3bc9l-root" data-fabric-component="BodyText">Minimum Experience</p></div><div class="fabric-15808a6-root MuiBox-root css-4cxybv" data-fabric-component="LayoutBox"><p class="fabric-958q8r-root" data-fabric-component="BodyText">Experienced</p></div><hr class="MuiDivider-root fabric-jcid1o-root MuiDivider-fullWidth MuiBox-root css-40h3v3" data-fabric-component="Divider"></div></div>

Back to blog

Common Interview Questions And Answers

1. HOW DO YOU PLAN YOUR DAY?

This is what this question poses: When do you focus and start working seriously? What are the hours you work optimally? Are you a night owl? A morning bird? Remote teams can be made up of people working on different shifts and around the world, so you won't necessarily be stuck in the 9-5 schedule if it's not for you...

2. HOW DO YOU USE THE DIFFERENT COMMUNICATION TOOLS IN DIFFERENT SITUATIONS?

When you're working on a remote team, there's no way to chat in the hallway between meetings or catch up on the latest project during an office carpool. Therefore, virtual communication will be absolutely essential to get your work done...

3. WHAT IS "WORKING REMOTE" REALLY FOR YOU?

Many people want to work remotely because of the flexibility it allows. You can work anywhere and at any time of the day...

4. WHAT DO YOU NEED IN YOUR PHYSICAL WORKSPACE TO SUCCEED IN YOUR WORK?

With this question, companies are looking to see what equipment they may need to provide you with and to verify how aware you are of what remote working could mean for you physically and logistically...

5. HOW DO YOU PROCESS INFORMATION?

Several years ago, I was working in a team to plan a big event. My supervisor made us all work as a team before the big day. One of our activities has been to find out how each of us processes information...

6. HOW DO YOU MANAGE THE CALENDAR AND THE PROGRAM? WHICH APPLICATIONS / SYSTEM DO YOU USE?

Or you may receive even more specific questions, such as: What's on your calendar? Do you plan blocks of time to do certain types of work? Do you have an open calendar that everyone can see?...

7. HOW DO YOU ORGANIZE FILES, LINKS, AND TABS ON YOUR COMPUTER?

Just like your schedule, how you track files and other information is very important. After all, everything is digital!...

8. HOW TO PRIORITIZE WORK?

The day I watched Marie Forleo's film separating the important from the urgent, my life changed. Not all remote jobs start fast, but most of them are...

9. HOW DO YOU PREPARE FOR A MEETING AND PREPARE A MEETING? WHAT DO YOU SEE HAPPENING DURING THE MEETING?

Just as communication is essential when working remotely, so is organization. Because you won't have those opportunities in the elevator or a casual conversation in the lunchroom, you should take advantage of the little time you have in a video or phone conference...

10. HOW DO YOU USE TECHNOLOGY ON A DAILY BASIS, IN YOUR WORK AND FOR YOUR PLEASURE?

This is a great question because it shows your comfort level with technology, which is very important for a remote worker because you will be working with technology over time...