Job description

Security Operations and Threat Hunting Analyst D&H is growing! Join 100+ year old Employee-Owned technology distributor, offering end-to-end solutions for today's resellers, retailers, and the clients they serve across the SMB and Consumer markets. • We are empowered by our employee Co-Owners who provide the industry’s best service, and we promote a collaborative culture. • We offer an Employee Stock Ownership Plan, 401k, Paid Time Off, Medical, Prescription, Dental and Vision benefits as well as Gym Reimbursement, Work from Home Reimbursement, Employee Purchase Program, Tuition Assistance and much more! • As a D&H Co-Owner you receive numerous discounts on services. • We feel strongly about giving back to the community and promoting sustainable, eco-friendly business practices. SUMMARY The Security Operations and Threat Hunting Analyst is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across D&H Distributing’s environment. This role focuses on identifying suspicious activity, analyzing security events, supporting incident response, and proactively hunting for threats that may evade automated controls. The analyst helps reduce risk by improving detection capabilities, documenting findings, supporting containment and remediation efforts, and strengthening the organization’s overall security posture. ESSENTIAL DUTIES AND RESPONSIBILITIES: • Monitor security alerts, logs, endpoint activity, network events, and other telemetry sources to identify suspicious or malicious activity • Investigate security events and incidents to determine scope, severity, root cause, affected systems, and appropriate response actions • Perform proactive threat hunting using security telemetry, threat intelligence, behavioral analysis, and knowledge of adversary tactics, techniques, and procedures • Develop, test, and refine hunting hypotheses to identify hidden threats, anomalous behavior, lateral movement, privilege misuse, persistence mechanisms, and other indicators of compromise • Lead incident response activities, including triage, containment, eradication, recovery, evidence gathering, and post-incident analysis • Use SIEM, EDR/XDR, email security, identity, cloud, vulnerability, and network security tools to correlate events and investigate potential threats • Analyze attacker behaviors, indicators of compromise, malware activity, phishing attempts, suspicious authentication patterns, endpoint activity, and network traffic • Create and improve detection logic, alerting rules, use cases, dashboards, playbooks, and investigative workflows to enhance monitoring and response capabilities • Leverage threat intelligence and frameworks such as MITRE ATT&CK, NIST, CIS, and related security guidance to inform investigations, threat hunts, and detection improvements • Document investigations, findings, timelines, evidence, response actions, and recommendations in a clear and complete manner • Coordinate with infrastructure, application, endpoint, cloud, and business teams to contain, remediate, and validate resolution of identified security issues • Identify opportunities to improve security visibility, reduce false positives, strengthen response procedures, and enhance overall SOC effectiveness • Stay current on emerging threats, vulnerabilities, attack techniques, security technologies, and industry trends relevant to detection and response • Effectively deal with rapid change in a positive manner • Participate in all company/location driven communication efforts, including huddles, department meetings, and other related efforts • Maintain a positive and professional working relationship with peers, management, support resources, and the community with a constant commitment to teamwork and exemplary customer service to present a professional image of D&H Distributing • Perform all other duties as assigned by management in a professional and efficient manner ADDITIONAL DUTIES: • Ability to communicate security risks, investigation results, and technical findings clearly to technical and non-technical audiences • Ability to manage multiple investigations, alerts, threat hunting activities, and competing priorities with appropriate urgency • Strong analytical thinking, time management, attention to detail, documentation, and communication skills QUALIFICATIONS • Exceptional verbal and written communication skills • Strong analytical, investigative, and problem-solving skills with the ability to evaluate complex technical information • Ability to communicate complex cybersecurity issues in business terms at any level within the organization • Ability to respond to security incidents, communicate critical risks, and discuss containment, remediation, and resolution actions with management • Highly self-motivated with a proactive mindset and curiosity for identifying hidden threats • Ability to prioritize and execute tasks in a high-pressure environment and make sound decisions during security events with appropriate guidance and supervision • Working knowledge of security monitoring, incident response, threat hunting, threat intelligence, network security, endpoint security, identity security, and common attack techniques EDUCATION and/or EXPERIENCE • Associate degree in Cybersecurity, Information Security, Computer Science, or a related area of study required, or equivalent years of related work experience • Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related area of study preferred • 5-10 years of experience in cybersecurity, security operations, incident response, threat detection, or related technical security functions preferred • Experience using SIEM, EDR/XDR, email security, vulnerability management, threat intelligence, case management, or other security operations tools preferred • Experience investigating phishing, malware, suspicious authentication activity, endpoint alerts, network anomalies, data exfiltration indicators, or other security events preferred • Industry certifications such as Security+, CySA+, GCIH, GCIA, GCFA, GNFA, GCTI, CEH, CISSP, or similar preferred • Scripting or automation experience in PowerShell, Python, Bash, or similar languages preferred • Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and common security operations processes preferred

Requirements

Must-haves

Security Operations and Threat Hunting Analyst
D&H is growing! Join 100+ year old Employee-Owned technology distributor, offering end-to-end solutions for today's resellers, retailers, and the clients they serve across the SMB and Consumer markets.
We are empowered by our employee Co-Owners who provide the industry’s best service, and we promote a collaborative culture.
As a D&H Co-Owner you receive numerous discounts on services.
We feel strongly about giving back to the community and promoting sustainable, eco-friendly business practices.
Monitor security alerts, logs, endpoint activity, network events, and other telemetry sources to identify suspicious or malicious activity
Investigate security events and incidents to determine scope, severity, root cause, affected systems, and appropriate response actions
Perform proactive threat hunting using security telemetry, threat intelligence, behavioral analysis, and knowledge of adversary tactics, techniques, and procedures
Develop, test, and refine hunting hypotheses to identify hidden threats, anomalous behavior, lateral movement, privilege misuse, persistence mechanisms, and other indicators of compromise
Lead incident response activities, including triage, containment, eradication, recovery, evidence gathering, and post-incident analysis
Use SIEM, EDR/XDR, email security, identity, cloud, vulnerability, and network security tools to correlate events and investigate potential threats
Analyze attacker behaviors, indicators of compromise, malware activity, phishing attempts, suspicious authentication patterns, endpoint activity, and network traffic
Create and improve detection logic, alerting rules, use cases, dashboards, playbooks, and investigative workflows to enhance monitoring and response capabilities
Leverage threat intelligence and frameworks such as MITRE ATT&CK, NIST, CIS, and related security guidance to inform investigations, threat hunts, and detection improvements
Document investigations, findings, timelines, evidence, response actions, and recommendations in a clear and complete manner
Coordinate with infrastructure, application, endpoint, cloud, and business teams to contain, remediate, and validate resolution of identified security issues
Identify opportunities to improve security visibility, reduce false positives, strengthen response procedures, and enhance overall SOC effectiveness

Nice-to-haves

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related area of study preferred
5-10 years of experience in cybersecurity, security operations, incident response, threat detection, or related technical security functions preferred
Experience using SIEM, EDR/XDR, email security, vulnerability management, threat intelligence, case management, or other security operations tools preferred
Experience investigating phishing, malware, suspicious authentication activity, endpoint alerts, network anomalies, data exfiltration indicators, or other security events preferred
Industry certifications such as Security+, CySA+, GCIH, GCIA, GCFA, GNFA, GCTI, CEH, CISSP, or similar preferred
Scripting or automation experience in PowerShell, Python, Bash, or similar languages preferred
Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and common security operations processes preferred

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

python

Platform: cornerstone
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401k

Paid Time Off