{"id":3417766,"url":"https://alion.io/job/sysco-cyber-threat-hunting-analyst","title":"Cyber Threat Hunting Analyst","company":{"id":1771007,"name":"Sysco","domain":"sysco.com","url":"https://alion.io/company/sysco-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":284,"ghost_share":0,"stale_share":0.951,"repost_share":0,"time_to_fill_p50_days":8,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":126000,"max_usd":240000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-28T20:02:03Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-10-31T23:17:11Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Company:\nUS6469 Sysco Payroll, Division of Sysco Resources Services, LLCSales Territory:\nNoneZip Code:\n77077Travel Percentage:\n0COMPENSATIONINFORMATION:\nThe pay range provided is not indicative of Sysco’s actual pay range but is merely algorithmic and provided for generalized comparison. Factors that may be used to determine rate of pay include specific skills, work location, work experience and other individualized factors\nJob Summary\nThe Cyber Threat Hunting Analyst serves as a technical lead for threat hunting, focusing on identifying advanced threats that evade traditional security controls. They design and drive hunt campaigns across endpoint, identity, cloud, email, and DNS/proxy data, and own the conversion of those hunts into durable detection and monitoring improvements. The role also provides guidance and mentorship to other hunters and analysts and represents threat hunting in cross-team detection and response strategy discussions. This is a hands-on role for an analyst with solid SOC/IR or detection experience who enjoys investigative work more than reacting solely to alerts.\nDuties and Responsibilities\nLead complex, proactive threat-hunting investigations across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud platforms, email, DNS and web proxy data to uncover previously undetected threats, attacker techniques and misconfigurations that bypass existing controls\nOwn the threat-hunting roadmap and backlog, defining and prioritizing hunt topics and maintaining playbooks and use cases based on threat intelligence, recent campaigns, penetration-test findings and knowledge of the environment\nEstablish and refine behavioral baselines for key users, systems and applications, using those baselines to distinguish benign anomalies from meaningful indicators of compromise or abuse during hunts and investigations\nTranslate successful hunts and identified patterns into detection content (rules, analytics, scheduled searches, watchlists) and lead the testing and tuning of new or updated detections and models with Detection Engineering to ensure effective, low-noise coverage before production rollout\nCollaborate with CTI analysts, SOC/Incident Response and offensive security/pentesters to operationalize intelligence, expand high-priority investigations and ensure exploited attack paths and high-risk behaviors are visible and monitored going forward.\nMaintain structured documentation of hunt hypotheses, methods, data sources, findings and outcomes; develop and maintain hunt playbooks and reusable queries; and serve as a technical mentor and escalation point for other hunters and analysts.\nQualifications\nEducation Required:\nBachelor’s degree in Cybersecurity, Computer Science\nEducation Preferred:\nMaster’s degree in Cybersecurity, Computer Science\nExperience Required:\n6+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.\nExperience Preferred:\n8+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.\nLicenses/Certifications Preferred:\nGCDA, GCIH, SC-200\nTechnical Skills and Abilities:\nAdvanced experience leading multi-source threat hunts across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud, email, DNS and web proxy data.\nStrong proficiency with SIEM / log query languages (e.g., KQL, S1QL) and building complex, ATT&CK-aligned hunting queries and analytics.\nDeep understanding of attacker TTPs and the MITRE ATT&CK framework, especially around credential theft, persistence, lateral movement, command and control, and data exfiltration.\nProven ability to establish and refine behavioral baselines for users, systems and applications, and to use those baselines to distinguish benign anomalies from meaningful indicators of compromise.\nExperience designing, testing and tuning detections and analytics derived from hunt results, including evaluating false-positive/false-negative trade-offs.\nStrong collaboration skills working with CTI, SOC/Incident Response, penetration testers and detection engineers to operationalize intelligence, expand investigations and validate coverage of attack paths.\nExcellent documentation and communication skills, including producing structured hunt reports, maintaining playbooks and reusable queries, and briefing security leadership on findings and coverage.\nAbility to act as a technical mentor and escalation point for other hunters and analysts, reviewing their hunts and improving analytical rigor and consistency.\nAdditional Requirements\nLanguage Requirements:\nStrong written and verbal communication skills in English are required.\nPhysical Demands:\nReasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.\nMay occasionally be required to support high-priority investigations or coordinated hunts outside of standard business hours.\nTravel Requirements:\nMinimal travel.\nWork Environment:\nHybrid Role based in the Houston office\nDecision Making Authority\nDecisions to be made independently without direction or supervision:\nSelects hypotheses, data sources, queries and investigative approaches for assigned hunts.\nDetermines which anomalies warrant deeper investigation and which can be closed as benign, documenting rationale.\nPrioritizes hunt workload across multiple concurrent hypotheses and campaigns based on risk and available data.\nProposes new or modified detections and analytics based on hunt results and observed patterns.\nStructures and documents hunt outputs, including timelines, findings and recommended follow-up actions.\nDecisions made with review/approval of other individuals/leadership:\nFinal selection and deployment of new or significantly changed detections and analytics into production monitoring.\nChanges to hunt roadmap focus that materially affect broader detection strategy or team priorities.\nRecommendations that drive new logging/data collection requirements or significant changes to existing telemetry.\nEscalation of major risks and gaps in coverage to leadership, including proposals for additional resourcing or tooling.\nBENEFITS INFORMATION:\nFor information on Sysco’s Benefits, please visit https://SyscoBenefits.comOVERVIEW:\nSysco is the global leader in foodservice distribution. With over 71,000 colleagues and a fleet of over 13,000 vehicles, Sysco operates approximately 333 distribution facilities worldwide and serves more than 700,000 customer locations.\nWe offer our colleagues the opportunity to grow personally and professionally, to contribute to the success of a dynamic organization, and to serve others in a manner that exceeds their expectations. We’re looking for talented, hard-working individuals to join our team. Come grow with us and let us show you why Sysco is at the heart of food and service.\nAFFIRMATIVE ACTION STATEMENT:\nApplicants must be currently authorized to work in the United States.\nWe are proud to be an Equal Opportunity and Affirmative Action employer, and consider qualified applicants without regard to race, color, creed, religion, ancestry, national origin, sex, sexual orientation, gender identity, age, disability, veteran status or any other protected factor under federal, state or local law.\nThis opportunity is available through Sysco Corporation, its subsidiaries and affiliates.","description_format":"text","description_chars":7483,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Incident Response","Wholesale","Food Logistics"],"lifecycle":[{"event":"open","at":"2026-10-28T20:02:03Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 5 · green card filings: 3","filings_12m":5,"filings_prev_12m":2,"green_card_filings_12m":3,"median_offered_wage_usd":139375,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":8,"reasons":["conf:1","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/sysco-cyber-threat-hunting-analyst","json_url":"https://alion.io/job/sysco-cyber-threat-hunting-analyst.json","meta":{"generated_at":"2026-11-01T03:51:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6049,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1771007},"rest":"https://alion.io/mcp/rest/get_company?id=1771007"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsysco-cyber-threat-hunting-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsysco-cyber-threat-hunting-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsysco-cyber-threat-hunting-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sysco-cyber-threat-hunting-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsysco-cyber-threat-hunting-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3417766}},{"tool":"search_jobs","arguments":{"company":"sysco.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3417766},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}