Senior Threat Hunter

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

As a Senior Threat Hunter/SOC Analyst within RSM Defense, you own high-severity security investigations and help guide the SOC’s technical direction across a growing managed security services environment supporting diverse client organizations. You will lead end-to-end incident analysis, validate adversary behavior, and translate evidence into clear containment and remediation guidance tailored to each client’s environment and risk context. You will also influence detection engineering and response automation by identifying content gaps, validating improvements against live telemetry, and converting operational lessons learned into durable, repeatable change.

The SOC operates on an integrated detection and response model across endpoint, identity, cloud, and network telemetry, supported by AI-assisted analysis and automation to reduce repetitive triage and maximize analyst focus on complex tradecraft, proactive improvements, and mentorship.

Key Responsibilities:

Advanced Investigation, Incident Handling & Incident Response

• Lead complex, high-severity investigations across endpoint, network, cloud, and identity telemetry.
• Perform root cause analysis and reconstruct incident timelines using aligned MITRE ATT&CK mapping.
• Serve as the primary technical liaison during escalated incidents, delivering clear findings and remediation steps to internal leadership and clients.
• Drive the creation of After-Action Reports (AARs) and lessons learned to improve tooling, detections, and workflow performance.

Detection Engineering & Content Support

• Identify detection gaps and collaborate with Detection Engineering to develop, refine, and tune detection content across relevant telemetry sources.
• Validate new detections before SOC deployment and provide measurable feedback based on production telemetry.

SOAR Automation & Workflow Optimization

• Leverage SOAR platforms to automate enrichment, triage, and response actions.
• Identify repetitive patterns ideal for automation and propose workflow enhancements to reduce MTTR.
• Validate automation logic prior to production rollout and ensure alignment with SOC escalation policies.
• Collaborate with engineering teams to incorporate additional enrichment sources, threat intel lookups, and AI-driven analysis steps.

AI, Machine Learning & Prompt Engineering

• Utilize AI copilots, enrichment agents, and LLM-based analysis tools to support case triage, enrichment, and investigation.
• Develop, optimize, and maintain prompt templates for SOC use cases (enrichment summaries, detection validation, log interpretation, hypothesis generation).
• Evaluate the accuracy and reliability of AI-generated outputs and implement QA steps to avoid hallucinations or misleading results.
• Identify opportunities to integrate AI agents into detection, triage, and response workflows—improving analyst speed and consistency.
• Provide feedback to engineering teams on model behavior, content gaps, and automation integration opportunities.

Threat Hunting & Proactive Analysis

• Support hypothesis-driven and intelligence-led hunts by validating findings, artifacts, and suspicious patterns.
• Recommend new hunts based on emerging TTPs, anomalous case trends, or telemetry gaps discovered during investigations.
• Ensure hunt findings translate into new detections, enhanced content, or instrumentation improvements.

Leadership, Mentoring & Team Development

• Mentor junior analysts on investigation techniques, tooling proficiency, case documentation, and proper analytical depth.
• Conduct quality reviews of Tier 1/2 case handling and provide constructive feedback.
• Contribute to training guides, runbooks, knowledge bases, and onboarding materials.
• Lead technical briefings, internal workshops, and knowledge-sharing sessions across SOC teams.

Reporting & Continuous Improvement

• Produce clear, concise, and accurate technical reports, incident summaries, and executive-friendly communications.
• Identify inefficiencies and propose enhancements in monitoring, detection logic, processes, and analyst training.

Required Qualifications:

• 5+ years in SOC / detection engineering / threat hunting / incident response (or equivalent depth)
• Demonstrated experience leading complex investigations and communicating findings to both technical and non-technical stakeholders
• Hands-on SIEM/EDR/XDR investigation experience and comfort writing or tuning detections (KQL/SPL/Sigma or similar)
• Strong working knowledge of incident response lifecycle and evidence-driven root cause analysis

Preferred Qualifications:

• Certifications such as GCIH, GCFA, GCDA, or similar.
• Experience with Elastic, Splunk, or other search-based platforms.
• Knowledge of the MITRE ATT&CK framework.
• Exposure to scripting languages for automation and enrichment.

Key Attributes:

• Curious and detail-oriented with a passion for proactive defense.
• Able to work independently or collaboratively in high-paced environments.
• Strong written and verbal communication skills.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.

This role provides a hands-on opportunity to engage in proactive threat detection and response activities and contribute directly to the maturity and effectiveness of the SOC’s security posture.

At RSM, we offer a competitive benefits and compensation package for all our people. We offer flexibility in your schedule, empowering you to balance life’s demands, while also maintaining your ability to serve clients. Learn more about our total rewards at https://rsmus.com/careers/working-at-rsm/benefits.

All applicants will receive consideration for employment as RSM does not tolerate discrimination and/or harassment based on race; color; creed; sincerely held religious beliefs, practices or observances; sex (including pregnancy or disabilities related to nursing); gender; sexual orientation; HIV Status; national origin; ancestry; familial or marital status; age; physical or mental disability; citizenship; political affiliation; medical condition (including family and medical leave); domestic violence victim status; past, current or prospective service in the US uniformed service; US Military/Veteran status; pre-disposing genetic characteristics or any other characteristic protected under applicable federal, state or local law. 

Accommodation for applicants with disabilities is available upon request in connection with the recruitment process and/or employment/partnership. RSM is committed to providing equal opportunity and reasonable accommodation for people with disabilities. If you require a reasonable accommodation to complete an application, interview, or otherwise participate in the recruiting process, please call us at 800-274-3978 or send us an email at [email protected].

RSM does not intend to hire entry level candidates who will require sponsorship now OR in the future (i.e. F-1 visa holders). If you are a recent U.S. college / university graduate possessing 1-2 years of progressive and relevant work experience in a same or similar role to the one for which you are applying, excluding internships, you may be eligible for hire as an experienced associate.

RSM will consider for employment qualified applicants with arrest or conviction records. For those living in California or applying to a position in California, please click here for additional information.

At RSM, an employee’s pay at any point in their career is intended to reflect their experiences, performance, and skills for their current role. The salary range (or starting rate for interns and associates) for this role represents numerous factors considered in the hiring decisions including, but not limited to, education, skills, work experience, certifications, location, etc. As such, pay for the successful candidate(s) could fall anywhere within the stated range.