Neos Consulting Group · 9 hours ago
Data Security Analyst II, Threat Hunter - Red Hat
Neos Consulting Group is seeking a skilled Data Security Analyst II (Threat Hunter) with a focus on Red Hat/Linux security for a contract role. The position involves proactive threat identification, analyzing security telemetry, and conducting investigations to mitigate risks in the enterprise environment.
Information ServicesInformation Technology
Responsibilities
Proactively hunt for threats by analyzing security telemetry and risk indicators across OAG’s enterprise environment, identifying suspicious activity, privilege misuse, persistence, and lateral movement
Lead deep-dive investigations in Red Hat / Linux (RHEL) environments by reviewing system logs, authentication activity, services, binaries, scheduled tasks, and network behavior to validate potential compromise
Partner with SIEM/Splunk engineering to implement and harden Copilot-driven Splunk workflows , including least-privilege access, secure data handling, logging/monitoring, and control validation to prevent data leakage or unintended exposure
Triage and assess risk severity to determine whether findings require escalation, containment, deeper investigation, or immediate mitigation actions
Conduct ethical hacking/adversary-based validation (within approved rules of engagement) to confirm exploitability, attack paths, and real-world impact to systems
Develop structured and repeatable threat hunting playbooks (signals, validation steps, evidence required, escalation triggers, and mitigation actions) and translate findings into detection requirements
Partner with SIEM/Splunk engineering to operationalize and automate playbooks into Splunk workflows, alerts, and response processes
Recommend security control enhancements and policy updates based on investigation outcomes, and document findings in a clear, defensible format for leadership and technical teams
Qualification
Required
6+ years of experience in threat hunting, incident response, or security investigations in a security enterprise environment
6+ years of extensive hands-on experience with Red Hat / Linux security (RHEL preferred)
3+ years experience supporting environments that include hybrid infrastructure (cloud + on-prem)
1+ years experience enabling and securing AI-driven SOC workflows, including Microsoft Copilot integration with SIEM platforms (Splunk preferred), with a focus on least-privilege access, data governance, auditability, and secure implementation patterns
Proven ability to analyze system-level telemetry and determine real risk vs noise
Strong experience performing deep investigative analysis and making escalation recommendations
Demonstrated experience with ethical hacking / adversary simulation and understanding how compromise occurs
Ability to develop structured playbooks and investigative procedures for repeatable threat hunting
Experience partnering with SIEM/Splunk teams to operationalize detection logic and automation
Preferred
Familiarity with common attacker techniques (MITRE ATT&CK mapping experience preferred)
Certifications are a plus (examples: Security+, CEH, OSCP, GIAC), but hands-on capability matters most