{"id":1220279,"url":"https://alion.io/job/dtcc-threat-hunt-senior-associate","title":"Threat Hunt Senior Associate","company":{"id":1759477,"name":"Depository Trust & Clearing Corporation","domain":"dtcc.com","url":"https://alion.io/company/dtcc-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":76,"open_postings":82,"ghost_share":0.012,"stale_share":0.915,"repost_share":0.024,"time_to_fill_p50_days":32,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tampa, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":94000,"max_usd":182000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CI/CD","optional":true},{"name":"Crowdstrike","optional":true},{"name":"GCP","optional":true},{"name":"Google SecOps","optional":true},{"name":"IAM","optional":true},{"name":"Kibana","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"NIST CSF","optional":true},{"name":"Okta","optional":true},{"name":"osquery","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-06-07T20:40:39Z","employer_posted_date":"2026-06-07","last_verified_at":"2026-10-26T00:27:56Z","board_verified":true,"closed_at":null,"days_open":140,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":140},"description":"Are you ready to make an impact at DTCC?\nDo you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We are committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world that we serve.\nThe Information Technology group delivers secure, reliable technology solutions that enable DTCC to be the trusted infrastructure of the global capital markets. The team delivers high-quality information through activities that include development of essential, building infrastructure capabilities to meet client needs and implementing data standards and governance.\nPay and Benefits:\nCompetitive compensation, including base pay and annual incentive\nComprehensive health and life insurance and well-being benefits, based on location\nPension / Retirement benefits\nPaid Time Off and Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.\nDTCC offers a flexible/hybrid model of 3 days onsite and 2 days remote (onsite Tuesdays, Wednesdays and a third day unique to each team or employee).\nThe Impact you will have in this role:\nBeing a member of CISO Team and as a Threat Hunt Senior Associate, you will execute hypothesis-driven hunts across endpoint, identity, network, and cloud telemetry; track and document hunt activity end-to-end; and translate findings into actionable improvements, detections, response playbooks, hardening tasks, and prioritized engineering work.\nThis role is hands-on and requires a practitioner mindset: you’ll spend your time asking better questions of the data, validating what “normal” looks like in complex systems, and proving or disproving attacker behaviors using repeatable methods. You’ll also provide surge support to incident response during investigations where hunt techniques accelerate containment and root cause analysis.\nThis is a mid-level role for someone who can operate independently on scoped hunts, communicate clearly, and contribute to a sustained, measurable hunting program.\nYour Primary Responsibilities:\nHunt Execution & Documentation (Core)\nExecute hypothesis-based threat hunts mapped to MITRE ATT&CK tactics/techniques, focusing on realistic adversary behaviors (credential access, persistence, lateral movement, defense evasion, and cloud abuse).\nUse behavioral analytics and anomaly detection to identify suspicious patterns across endpoint + identity + cloud + network telemetry, then validate with deeper artifact review.\nPerform, track, and record hunt activity in a structured way: hypotheses, datasets queried, query versions, findings (positive/negative), evidence, confidence, and follow-up actions.\nMaintain clean, audit-ready hunt notes that allow another analyst to reproduce your work and understand decisions made under uncertainty.\nInvestigative Workflows & Telemetry Correlation\nCorrelate logs across EDR/XDR, SIEM, cloud control plane logs, identity logs, and container/Kubernetes telemetry to build a coherent narrative from partial signals.\nInvestigate attacker tradecraft such as:Credential theft and replay (token theft, OAuth abuse, suspicious refresh patterns)\n“Living off the land” execution (PowerShell, WMI, LOLBins on Windows; bash/curl/wget/systemd on Linux)\nPersistence mechanisms (scheduled tasks/cron, service modifications, registry run keys, launch agents)\n\nCommand-and-control behaviors and egress anomalies (beaconing, domain fronting indicators, unusual TLS fingerprints where available)\nCloud and Kubernetes abuse (suspicious role assumptions, unusual API call sequences, kubeconfig access, container escape precursors)\nTriage and deepen suspicious signals into defensible findings: timeline, scope, impact, root cause, and containment recommendations.\nDetection Engineering & Continuous Improvement\nTranslate hunt results into durable controls: new detections, tuning improvements, telemetry onboarding, or gaps to address (instrumentation, logging coverage, parsing, enrichment).\nDraft and iterate detection logic (e.g., Sigma/YARA, SIEM analytics rules, EDR custom IOAs) with measurable success criteria: false-positive rate, time-to-detect improvements, and coverage mapped to ATT&CK.\nPartner with SOAR/automation engineers to operationalize repetitive enrichment and triage steps into playbooks.\nPurple Teaming & Adversary Simulation\nCollaborate with Red Team / Purple Team efforts to validate detection coverage, refine alerts, and ensure hunts align to current and relevant TTPs.\nHelp design and execute controlled simulations (atomic tests, adversary emulation plans), then close the loop by updating detections, documentation, and response procedures.\nIncident Support (When Needed) \nProvide incident surge support: rapid scoping queries, hunting for related activity, identifying patient-zero candidates, and strengthening containment decisions with evidence.\nContribute to post-incident reviews by identifying detection gaps, improving playbooks, and capturing lessons learned as backlog items.\n**NOTE: The Primary Responsibilities of this role are not limited to the details above. **\nQualifications:\nMin 3-6 years of relevant experience\nBachelor’s Degree and/or equivalent experience\n3-6 years in Threat Hunting, Detection Engineering, Incident Response, or SOC investigations in a production environment (financial services/fintech experience is a plus but not required).\nDemonstrated experience running hypothesis-driven hunts and documenting outcomes in a way that supports repeatability and measurement.\nStrong log analysis skills and comfort working across multiple telemetry sources (endpoint, identity, network, cloud).\nPractical detection and query experience in one or more:KQL (Microsoft Sentinel / Defender)\nSplunk SPL\nElastic/Kibana (EQL/KQL/Lucene)\nChronicle/Google SecOps query language or equivalent\n\nSolid operating system fundamentals: \nWindows internals basics (process ancestry, services, scheduled tasks, registry persistence)\nLinux fundamentals (systemd, cron, auth logs, process/network inspection)\nFamiliarity with attacker tradecraft and investigative methods aligned to MITRE ATT&CK; ability to map raw evidence to techniques without forcing it.\nAbility to communicate clearly-writeups that separate observation from inference, quantify confidence, and identify next steps.\nProven ability to prioritize: know when you have enough evidence to escalate vs. when to keep iterating.\nTalents Needed for Success:\nExperience hunting across cloud + containerized environments (AWS/Azure/GCP; Kubernetes; CI/CD telemetry).\nExperience developing or tuning detections using Sigma, YARA, EDR custom detections, or SIEM correlation rules.\nFamiliarity with NIST CSF / NIST 800-61 incident response concepts and how hunting feeds detection/response maturity.\nExperience with SOAR automation, enrichment pipelines, and case management workflows.\nComfortable scripting for analysis and automation (Python, PowerShell, Bash) and using tools like jq, osquery, CyberChef.\nCertifications (any of the following are valued):\nGCFA, GCIH, GCIA\nOSCP (useful signal for investigative depth; not required)\nCISSP (helpful for program maturity context; not required)\nTools & Technologies\nYou won’t need every item day one-but you should be comfortable learning quickly and working across a modern stack.\nEDR/XDR: Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne (or equivalent)\nSIEM / Analytics: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL/KQL), Chronicle/Google SecOps\nCloud & Identity: Azure/AWS logs, Entra ID/Azure AD, Okta (or equivalent), CloudTrail/Activity Logs, IAM telemetry\nContainers: Kubernetes audit logs, container runtime signals, registry, and CI/CD telemetry\nDetection Content: Sigma, YARA, ATT&CK mappings, custom IOAs, correlation rules\nWorkflow: Case management, runbooks/playbooks, SOAR tooling, structured reporting, and metrics\nThe salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.","description_format":"text","description_chars":8927,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Stock Exchanges & Market Infrastructure","Custody & Fund Administration"],"lifecycle":[{"event":"open","at":"2026-09-25T11:46:11Z"}],"visa":[],"liveness":{"score":9,"band":"cold","label":"Long shot","p_open":1,"p_active":0.314,"p_room":0.28,"age_days":140,"expected_fill_days":32,"reasons":["conf:5","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/dtcc-threat-hunt-senior-associate","json_url":"https://alion.io/job/dtcc-threat-hunt-senior-associate.json","meta":{"generated_at":"2026-10-26T06:28:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8728,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1759477},"rest":"https://alion.io/mcp/rest/get_company?id=1759477"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdtcc-threat-hunt-senior-associate"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdtcc-threat-hunt-senior-associate"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdtcc-threat-hunt-senior-associate"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/dtcc-threat-hunt-senior-associate\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdtcc-threat-hunt-senior-associate"}]}