{"id":2222106,"url":"https://alion.io/job/sixgen-threat-hunterpurple-team-operator","title":"Threat Hunter/Purple Team Operator","company":{"id":686212,"name":"SIXGEN","domain":"sixgen.io","url":"https://alion.io/company/sixgen","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":81,"open_postings":21,"ghost_share":0.238,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":95,"computed_at":"2026-10-20T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":88000,"max_usd":190000,"period":"year","method":"global_role_seniority_cell","sample_n":714},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Carbon Black","optional":false},{"name":"Cobalt Strike","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Havoc","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Suricata","optional":false},{"name":"Zeek","optional":false},{"name":"PowerShell","optional":true}],"status":"live","first_seen_at":"2026-10-10T12:50:36Z","employer_posted_date":"2026-10-10","last_verified_at":"2026-10-20T04:29:34Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":9},"description":"Threat Hunter / Purple Team Operator\nSIXGEN's mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and leading technical capabilities to uncover vulnerabilities, protect vital systems, and strengthen operational resilience.\nPOSITION OVERVIEW\nPosition: Mid-Level Threat Hunter / Purple Team Operator\nJob Type: Full Time\nLocation: Remote with travel to customers and test locations as required\nClearance Requirement: Active Top Secret with SCI eligibility\nWHAT YOU'LL DO\nSIXGEN is seeking a mid-level Threat Hunter / Purple Team Operator to identify threats that evade existing detection methods, develop and test hunting hypotheses, and feed findings back into detection engineering. This role will combine remote threat hunting and on-site purple team coordination in direct support of red team engagements to secure systems, strengthen the defenders, and build and validate detection methods that can catch offensive traffic in real time.\nThis role requires comfort working independently through remote hunts as well as the ability to translate adversary tradecraft into defensive guidance.\nResponsibilities include:\nConduct hypothesis-driven and intelligence-led threat hunts across endpoints, networks, and cloud telemetry for several weeks prior to each red team engagement.\nAnalyze logs, alerts, and historical data for indicators of compromise (IOCs), anomalous behavior, and adversary TTPs mapped to the MITRE ATT&CK from partner-provided sources (EDR, SIEM, authentication/identify logs).\nDocument hunt coverage and methodology, findings, detection recommendations, and any confirmed or suspected compromise, escalating immediately if active adversary activity is found.\nDeliver a threat hunt summary and determine if the customer environment is clear prior to red team assessments.\nPartner with blue teams during the purple portion of the engagement to assist in detecting, tuning, and validating controls against red team TTPs in real-time.\nBrief technical and non-technical stakeholders on hunt result and purple team detection outcomes.\nServe as a Trusted Agent during the red team assessment and maintain strict confidentiality and operational security with insight into both red and blue team activity.\nTechnology proficiency includes:\nSIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic).\nEDR/XDR tooling (e.g. CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Carbon Black).\nNetwork detection and traffic analysis tools (e.g. Zeek, Suricata, full packet capture).\nLog aggregation and correlation across endpoint, network, cloud, and identity sources (e.g., Azure AD/Entra ID, AWS CloudTrail, Microsoft 365).\nMITRE ATT&CK framework for mapping hunts and detections to adversary TTPs.\nQuery and scripting languages for hunting and automation (e.g. KQL, SPL, Python).\nFamiliarity with common red team tooling and tradecraft (e.g., Cobalt Strike, Havoc, and other C2 traffic patterns) to help recognize and detect it.\nWHAT YOU BRING\nRequired qualifications:\n3 - 5+ years of experience in threat hunting, SOC/detection engineering, incident response, or a closely related defensive security role.\nHand-on experience working with a major SIEM and EDR platform.\nWorking knowledge of the MITRE ATT&CK framework and how to map observed activity to adversary TTPs.\nUnderstanding of common adversary tradecraft and red team testing methodology to help close detection gaps.\nStrong written and verbal communication skills with the ability to produce clear, customer-facing findings and an “all clear” determination.\nComfortable operating independently in remote, customer-facing roles.\nU.S. citizenship, with eligibility to obtain and maintain a U.S. government security clearance.\nPreferred qualifications:\nIndustry certifications such as GCFA, GCIH, GNFA, GCTI, CySA+, or equivalent.\nPrior experience performing threat hunting and/or purple team role working directly alongside a red team.\nScripting and automation experience to streamline hunting workflows (e.g., Python, PowerShell).\nPrior experience working with multiple partner organizations or client environments.\nActive TS/SCI clearance.\nCOMPENSATION AND BENEFITS\nSIXGEN offers competitive compensation based on the responsibilities of the role and the candidate's experience, qualifications, specialized expertise, and security-clearance status. The final compensation package will be discussed during the hiring process.\nSIXGEN offers benefits for full-time employees, including:\nEmployer-paid health insurance premiums, including medical, dental, and vision coverage, for employees and their families\nEmployer-paid short- and long-term disability insurance and basic life and AD&D insurance\n401(k) plan with a 4% employer contribution\nProfessional-development reimbursement options for training, certifications, and education\nFlexible and remote-work policies for most positions\nFlexible paid time off and holiday schedule\nFor more information, please contact Human Strategist Amy Maxwell at .\nOUR COMMITMENT\nSIXGEN is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, marital status, ancestry, protected veteran status, or any other characteristic protected by applicable law.\nWe are committed to fostering an inclusive culture that values diversity in our people and reflects the communities and customers we serve. We strive to attract and retain a diverse talent pool and to create an environment where everyone is empowered to do their best work.","description_format":"text","description_chars":5786,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Cybersecurity","National Security","Homeland Security"],"lifecycle":[{"event":"open","at":"2026-10-10T14:12:15Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":9,"expected_fill_days":95,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-10-20T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/sixgen-threat-hunterpurple-team-operator","json_url":"https://alion.io/job/sixgen-threat-hunterpurple-team-operator.json","meta":{"generated_at":"2026-10-20T06:04:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6584,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":686212},"rest":"https://alion.io/mcp/rest/get_company?id=686212"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsixgen-threat-hunterpurple-team-operator"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsixgen-threat-hunterpurple-team-operator"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsixgen-threat-hunterpurple-team-operator"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sixgen-threat-hunterpurple-team-operator\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsixgen-threat-hunterpurple-team-operator"}]}