Cyber Threat Hunter

College Board is hiring a Cyber Threat Hunter to help defend the cloud and enterprise environments supporting its Digital SAT, AP, and other high-stakes programs. The role focuses on proactive threat hunting, detection engineering, incident investigation, purple team validation, and automation in an AWS-heavy environment.

What you'll do:

• Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry, starting alongside senior engineers, and document findings and recommended control or detection improvements
• Help build, tune, and maintain detections focused on high-risk behaviors such as IAM misuse, persistence, privilege escalation, and data access or exfiltration
• Reduce alert noise through structured tuning, baselining, and enrichment while preserving meaningful coverage
• Map detections and hunts to MITRE ATT&CK techniques to identify and close visibility gaps
• Support investigation and containment of security incidents by performing log analysis, helping scope impact, and documenting findings
• Contribute to the development and refinement of incident response playbooks for common cloud and identity-based scenarios
• Contribute clear after-action reports that identify root cause, control gaps, and prioritized remediation steps
• Participate in periodic tabletop or fire drill exercises to validate readiness and improve response coordination
• Participate in purple team exercises to validate detection effectiveness and help prioritize remediation of identified gaps
• Partner with offensive testing and engineering teams to translate findings into improved detections and hardened configurations
• Identify opportunities to strengthen logging, telemetry coverage, and control effectiveness across cloud and enterprise systems
• Develop lightweight automation and scripts to improve investigation speed, enrichment, and reporting consistency

What they're looking for:

• 1 to 3 years of experience in cyber defense, such as threat hunting, detection engineering, SOC analysis, or incident response, in enterprise environments
• Recent graduates with a year or more of relevant hands-on experience are encouraged to apply
• A clear understanding of threat hunting as a proactive, hypothesis-driven practice, and how it differs from incident response
• Strong foundations in endpoint and operating system behavior, including process trees, parent and child processes, and how to recognize anomalous activity
• Foundational to moderate cloud security experience in AWS, including working with cloud-native telemetry (for example CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch logs, and GuardDuty)
• Hands-on experience writing queries and working with security telemetry such as EDR, SIEM, and authentication logs, including tuning detections to improve signal-to-noise
• Experience supporting incident response, including triage, log analysis, scoping, and documentation
• Strong written and verbal communication skills, including documenting investigations clearly and explaining findings to technical and non-technical stakeholders
• A collaborative mindset with experience partnering across engineering, architecture, and development teams
• Eagerness to learn quickly, ask good questions, and bring a fresh perspective to established processes
• A passion for expanding educational and career opportunities and mission-driven work
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively

Benefits:

• Fully remote role; candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).