Security Operations & Threat Hunting Analyst

About the role

The Security Operations and Threat Hunting Analyst is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across D&H Distributing’s environment. This role focuses on identifying suspicious activity, analyzing security events, supporting incident response, and proactively hunting for threats that may evade automated controls. The analyst helps reduce risk by improving detection capabilities, documenting findings, supporting containment and remediation efforts, and strengthening the organization’s overall security posture.

Responsibilities

• Monitor security alerts, logs, endpoint activity, network events, and other telemetry sources to identify suspicious or malicious activity
• Investigate security events and incidents to determine scope, severity, root cause, affected systems, and appropriate response actions
• Perform proactive threat hunting using security telemetry, threat intelligence, behavioral analysis, and knowledge of adversary tactics, techniques, and procedures
• Develop, test, and refine hunting hypotheses to identify hidden threats, anomalous behavior, lateral movement, privilege misuse, persistence mechanisms, and other indicators of compromise
• Lead incident response activities, including triage, containment, eradication, recovery, evidence gathering, and post-incident analysis
• Use SIEM, EDR/XDR, email security, identity, cloud, vulnerability, and network security tools to correlate events and investigate potential threats
• Analyze attacker behaviors, indicators of compromise, malware activity, phishing attempts, suspicious authentication patterns, endpoint activity, and network traffic
• Create and improve detection logic, alerting rules, use cases, dashboards, playbooks, and investigative workflows to enhance monitoring and response capabilities
• Leverage threat intelligence and frameworks such as MITRE ATT&CK, NIST, CIS, and related security guidance to inform investigations, threat hunts, and detection improvements
• Document investigations, findings, timelines, evidence, response actions, and recommendations in a clear and complete manner
• Coordinate with infrastructure, application, endpoint, cloud, and business teams to contain, remediate, and validate resolution of identified security issues
• Identify opportunities to improve security visibility, reduce false positives, strengthen response procedures, and enhance overall SOC effectiveness
• Stay current on emerging threats, vulnerabilities, attack techniques, security technologies, and industry trends relevant to detection and response
• Effectively deal with rapid change in a positive manner
• Participate in all company/location driven communication efforts, including huddles, department meetings, and other related efforts
• Maintain a positive and professional working relationship with peers, management, support resources, and the community with a constant commitment to teamwork and exemplary customer service to present a professional image of D&H Distributing
• Perform all other duties as assigned by management in a professional and efficient manner

• Ability to communicate security risks, investigation results, and technical findings clearly to technical and non-technical audiences
• Ability to manage multiple investigations, alerts, threat hunting activities, and competing priorities with appropriate urgency
• Strong analytical thinking, time management, attention to detail, documentation, and communication skills

Requirements

• Exceptional verbal and written communication skills
• Strong analytical, investigative, and problem-solving skills with the ability to evaluate complex technical information
• Ability to communicate complex cybersecurity issues in business terms at any level within the organization
• Ability to respond to security incidents, communicate critical risks, and discuss containment, remediation, and resolution actions with management
• Highly self-motivated with a proactive mindset and curiosity for identifying hidden threats
• Ability to prioritize and execute tasks in a high-pressure environment and make sound decisions during security events with appropriate guidance and supervision
• Working knowledge of security monitoring, incident response, threat hunting, threat intelligence, network security, endpoint security, identity security, and common attack techniques

• Associate degree in Cybersecurity, Information Security, Computer Science, or a related area of study required, or equivalent years of related work experience
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related area of study preferred
• 5-10 years of experience in cybersecurity, security operations, incident response, threat detection, or related technical security functions preferred
• Experience using SIEM, EDR/XDR, email security, vulnerability management, threat intelligence, case management, or other security operations tools preferred
• Experience investigating phishing, malware, suspicious authentication activity, endpoint alerts, network anomalies, data exfiltration indicators, or other security events preferred
• Industry certifications such as Security+, CySA+, GCIH, GCIA, GCFA, GNFA, GCTI, CEH, CISSP, or similar preferred
• Scripting or automation experience in PowerShell, Python, Bash, or similar languages preferred
• Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and common security operations processes preferred

Benefits

• Employee Stock Ownership Plan (ESOP)
• 401k
• Paid Time Off
• Medical, Prescription, Dental and Vision benefits
• Gym Reimbursement
• Work from Home Reimbursement
• Employee Purchase Program
• Tuition Assistance
• Numerous discounts on services for Co-Owners