Cyber Threat Hunter

College Board – Technology – Information Security Office

Location: This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).

Type: This is a full-time position

About the Team 

The Cyber Security Operations team is critical to the strategic foundation of our products, most notably the secure delivery of our Digital SAT and AP programs. We are a highly motivated group of cyber security professionals who take a proactive approach to ensuring a strong security posture. We partner across the organization to mature our Threat Management and Incident Response procedures and are constantly seeking and experimenting with new technologies. We are currently using a variety of cutting-edge tools that provide comprehensive cyber security operations for the College Board’s critical infrastructure in support of the College Board’s mission to connect students to college success and opportunity.

We learn by doing. The team experiments with different ideas, works out solutions together, and encourages each person to pursue what they are passionate about, whether that is building a new capability, automating threat hunts, or creating new internal tools. A strong managed detection and response partnership and a deliberately balanced on-call model keep alert fatigue low, so the team can focus on meaningful threat hunting and the investigations that matter.

About the Opportunity  

As a Cyber Threat Hunter, you will play a hands-on role in defending the cloud and enterprise environments that power the Digital SAT, AP, and other high-stakes programs. You will work in an AWS-heavy environment at national scale, where proactive, hypothesis-driven threat hunting, careful investigation, and clear documentation directly support exam integrity and student trust.

This is an early-career role for someone with strong cyber defense foundations who is eager to learn fast. You will start by getting to know our environment and tools, then move into threat hunts paired with senior engineers, help build and tune detections, support incident investigations, and bring a fresh perspective to our playbooks. Over time, you will help validate controls through purple team exercises and use automation to make our workflows faster and more reliable.

You will partner closely with engineers, architects, product security, GRC, and product teams to close visibility gaps and reduce risk in practical, measurable ways. Success in this role means fewer blind spots, higher fidelity alerts, and a cyber defense program that is proactive rather than reactive.

In this role, you will:

Threat Hunting & Detection Engineering (45%)

• Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry, starting alongside senior engineers, and document findings and recommended control or detection improvements.
• Help build, tune, and maintain detections focused on high-risk behaviors such as IAM misuse, persistence, privilege escalation, and data access or exfiltration.
• Reduce alert noise through structured tuning, baselining, and enrichment while preserving meaningful coverage.
• Map detections and hunts to MITRE ATT&CK techniques to identify and close visibility gaps.

Incident Response & Investigation (30%)

• Support investigation and containment of security incidents by performing log analysis, helping scope impact, and documenting findings.
• Contribute to the development and refinement of incident response playbooks for common cloud and identity-based scenarios.
• Contribute clear after-action reports that identify root cause, control gaps, and prioritized remediation steps.
• Participate in periodic tabletop or fire drill exercises to validate readiness and improve response coordination.

Purple Teaming & Continuous Improvement (15%)

• Participate in purple team exercises to validate detection effectiveness and help prioritize remediation of identified gaps.
• Partner with offensive testing and engineering teams to translate findings into improved detections and hardened configurations.
• Identify opportunities to strengthen logging, telemetry coverage, and control effectiveness across cloud and enterprise systems.

Automation, Documentation & Knowledge Sharing (10%)

• Develop lightweight automation and scripts to improve investigation speed, enrichment, and reporting consistency.
• Use LLMs and AI tools to speed up enrichment, automation, and tool development, validating output before relying on it.
• Maintain well-documented detection logic, hunt results, and response procedures to improve repeatability and team scalability.
• Share threat insights and lessons learned with the broader security and engineering community through briefings or written updates.

About you, you have:

• 1 to 3 years of experience in cyber defense, such as threat hunting, detection engineering, SOC analysis, or incident response, in enterprise environments. Recent graduates with a year or more of relevant hands-on experience are encouraged to apply.
• A clear understanding of threat hunting as a proactive, hypothesis-driven practice, and how it differs from incident response.
• Strong foundations in endpoint and operating system behavior, including process trees, parent and child processes, and how to recognize anomalous activity.
• Foundational to moderate cloud security experience in AWS, including working with cloud-native telemetry (for example CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch logs, and GuardDuty).
• Hands-on experience writing queries and working with security telemetry such as EDR, SIEM, and authentication logs, including tuning detections to improve signal-to-noise. Experience with Sumo Logic is a plus.
• Experience supporting incident response, including triage, log analysis, scoping, and documentation.
• Strong written and verbal communication skills, including documenting investigations clearly and explaining findings to technical and non-technical stakeholders.
• A collaborative mindset with experience partnering across engineering, architecture, and development teams.
• Eagerness to learn quickly, ask good questions, and bring a fresh perspective to established processes.

Nice to have

• Relevant certifications (for example GCIA, GCIH, GNFA, AWS Security Specialty, Security+).
• Familiarity with modern cloud platforms such as containers and Kubernetes, serverless, and CI/CD pipelines, and detecting identity-based attacks in cloud environments.
• Strong automation and scripting skills (for example Python, PowerShell, Bash) to streamline investigations, enrich alerts, and improve repeatability across hunting and response workflows.
• Familiarity with using LLMs and AI tooling to automate security workflows.
• Exposure to purple team or detection validation activities, and to mapping detections to MITRE ATT&CK.
• Exposure to investigative and forensic methods, such as log forensics, timeline analysis, and evidence handling.
• Experience in an MDR, SOC, or GRC role with incident response exposure.

All roles at College Board require:

• A passion for expanding educational and career opportunities and mission-driven work
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.
• Clear and concise communication skills, written and verbal
• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success
• Authorization to work in the United States

About Our Process

• Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.
• While the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks.

What We Offer

At College Board, we offer more than a paycheck: we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market.

A Thoughtful Approach to Compensation

• The hiring range for this role is $116,000–$125,000.
• Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at the College Board.
• We aim to make our best offer upfront, rooted in fairness, transparency, and market data.
• We adjust salaries by location to ensure fairness, no matter where you live.

You’ll have open, transparent conversations about compensation, benefits, and what it’s like to work at College Board throughout your hiring process. Check out our careers page for more.

#LI-Remote

#LI-TheAcorn