Threat Hunter/Purple Team Operator

The role

This person will conduct hypothesis-driven threat hunts and coordinate purple team activities. They will identify threats, develop hunting hypotheses, and feed findings into detection engineering to support red team engagements.

What you will do

• Conduct hypothesis-driven and intelligence-led threat hunts across endpoints, networks, and cloud telemetry.
• Analyze logs, alerts, and historical data for indicators of compromise and adversary TTPs.
• Document hunt coverage, methodology, findings, and detection recommendations.
• Deliver a threat hunt summary and determine if the customer environment is clear.
• Partner with blue teams during purple team engagements to assist in detecting and validating controls.
• Brief technical and non-technical stakeholders on hunt results and detection outcomes.
• Serve as a Trusted Agent during red team assessments.

Required qualifications

• 3 – 5+ years of experience in threat hunting, SOC/detection engineering, incident response, or a closely related defensive security role.
• Hand-on experience working with a major SIEM and EDR platform.
• Working knowledge of the MITRE ATT&CK framework.
• Understanding of common adversary tradecraft and red team testing methodology.
• Strong written and verbal communication skills.
• Comfortable operating independently in remote, customer-facing roles.
• U.S. citizenship.
• Eligibility to obtain and maintain a U.S. government security clearance.
• Active Top Secret with SCI eligibility.

Nice to have

• Industry certifications such as GCFA, GCIH, GNFA, GCTI, CySA+, or equivalent.
• Prior experience performing threat hunting and/or purple team role working directly alongside a red team.
• Scripting and automation experience to streamline hunting workflows (e.g., Python, PowerShell).
• Prior experience working with multiple partner organizations or client environments.
• Active TS/SCI clearance.

Benefits

• Employer-paid health insurance premiums, including medical, dental, and vision coverage, for employees and their families
• Employer-paid short- and long-term disability insurance and basic life and AD&D insurance
• 401(k) plan with a 4% employer contribution
• Professional-development reimbursement options for training, certifications, and education
• Flexible and remote-work policies for most positions
• Flexible paid time off and holiday schedule

Before you apply

• Active Top Secret with SCI eligibility required.
• U.S. citizenship required.

About the company

SIXGEN delivers agile, mission-ready cybersecurity solutions to empower government and critical infrastructure organizations. They combine innovation and technical capabilities to protect vital systems and strengthen operational resilience.