Cyber hunter

College Board – Technology – Information Security Office

Location:

This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).
Type:

This is a full-time position
The Cyber Security Operations team is critical to the strategic foundation of our products, most notably the secure delivery of our Digital SAT and AP programs. We are a highly motivated group of cyber security professionals who take a proactive approach to ensuring a strong security posture. We partner across the organization to mature our Threat Management and Incident Response procedures and are constantly seeking and experimenting with new technologies. We are currently using a variety of cutting-edge tools that provide comprehensive cyber security operations for the College Board’s critical infrastructure in support of the College Board’s mission to connect students to college success and opportunity.
The team experiments with different ideas, works out solutions together, and encourages each person to pursue what they are passionate about, whether that is building a new capability, automating threat hunts, or creating new internal tools. A strong managed detection and response partnership and a deliberately balanced on-call model keep alert fatigue low, so the team can focus on meaningful threat hunting and the investigations that matter.
As a Cyber Threat Hunter, you will play a hands-on role in defending the cloud and enterprise environments that power the Digital SAT, AP, and other high-stakes programs. You will work in an AWS-heavy environment at national scale, where proactive, hypothesis-driven threat hunting, careful investigation, and clear documentation directly support exam integrity and student trust.
This is an early-career role for someone with strong cyber defense foundations who is eager to learn fast. You will start by getting to know our environment and tools, then move into threat hunts paired with senior engineers, help build and tune detections, support incident investigations, and bring a fresh perspective to our playbooks. Over time, you will help validate controls through purple team exercises and use automation to make our workflows faster and more reliable.
You will partner closely with engineers, architects, product security, GRC, and product teams to close visibility gaps and reduce risk in practical, measurable ways. Success in this role means fewer blind spots, higher fidelity alerts, and a cyber defense program that is proactive rather than reactive.
Execute hypothesis-driven threat hunts across AWS, identity, endpoint, and network telemetry, starting alongside senior engineers, and document findings and recommended control or detection improvements.
Help build, tune, and maintain detections focused on high-risk behaviors such as IAM misuse, persistence, privilege escalation, and data access or exfiltration.
Reduce alert noise through structured tuning, baselining, and enrichment while preserving meaningful coverage.
Support investigation and containment of security incidents by performing log analysis, helping scope impact, and documenting findings.
Contribute to the development and refinement of incident response playbooks for common cloud and identity-based scenarios.
Participate in periodic tabletop or fire drill exercises to validate readiness and improve response coordination.
Participate in purple team exercises to validate detection effectiveness and help prioritize remediation of identified gaps.
Identify opportunities to strengthen logging, telemetry coverage, and control effectiveness across cloud and enterprise systems.
Maintain well-documented detection logic, hunt results, and response procedures to improve repeatability and team scalability.
Share threat insights and lessons learned with the broader security and engineering community through briefings or written updates.
1 to 3 years of experience in cyber defense, such as threat hunting, detection engineering, SOC analysis, or incident response, in enterprise environments. Recent graduates with a year or more of relevant hands-on experience are encouraged to apply.
~ Strong foundations in endpoint and operating system behavior, including process trees, parent and child processes, and how to recognize anomalous activity.
~ Foundational to moderate cloud security experience in AWS, including working with cloud-native telemetry (for example CloudTrail, IAM, S3, VPC Flow Logs, CloudWatch logs, and GuardDuty).
~ Hands-on experience writing queries and working with security telemetry such as EDR, SIEM, and authentication logs, including tuning detections to improve signal-to-noise. Experience supporting incident response, including triage, log analysis, scoping, and documentation.
~ Strong written and verbal communication skills, including documenting investigations clearly and explaining findings to technical and non-technical stakeholders.
~ Relevant certifications (for example GCIA, GCIH, GNFA, AWS Security Specialty, Security+).
Familiarity with modern cloud platforms such as containers and Kubernetes, serverless, and CI/CD pipelines, and detecting identity-based attacks in cloud environments.
Strong automation and scripting skills (for example Python, PowerShell, Bash) to streamline investigations, enrich alerts, and improve repeatability across hunting and response workflows.
Exposure to investigative and forensic methods, such as log forensics, timeline analysis, and evidence handling.
Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.
A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
Application review will begin immediately and will continue until the position is filled. This role is expected to accept applications for a minimum of 5 business days.
While the hiring process may vary, it generally includes: resume and application submission, recruiter phone/video screen, hiring manager interview, performance exercise such as live coding, a panel interview, a conversation with leadership and reference checks.
At College Board, we offer more than a paycheck: we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. We’re a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market.
We aim to make our best offer upfront, rooted in fairness, transparency, and market data.
LI-Remote