Cloud Threat Hunter (Cyber)

We are

At Synechron, we believe in the power of digital to transform businesses for the better. Our global consulting firm combines creativity and innovative technology to deliver industry-leading digital solutions. Synechron’s progressive technologies and optimization strategies span end-to-end Artificial Intelligence, Consulting, Digital, Cloud & DevOps, Data, and Software Engineering, servicing an array of noteworthy financial services and technology firms. Through research and development initiatives in our FinLabs we develop solutions for modernization, from Artificial Intelligence and Blockchain to Data Science models, Digital Underwriting, mobile-first applications and more. Over the last 20+ years, our company has been honored with multiple employer awards, recognizing our commitment to our talented teams. With top clients to boast about, Synechron has a global workforce of 17,000+, and has 58 offices in 22 countries within key global markets.

About the Role

We are seeking an experienced AWS Cloud Threat Hunter / Cybersecurity Analyst to identify, investigate, and respond to advanced cyber threats across AWS cloud environments. This role will proactively search for indicators of compromise, suspicious activity, attack patterns, and emerging threats across cloud infrastructure, identities, applications, and workloads.

The successful candidate will work closely with Security Operations, Cloud Engineering, Infrastructure, DevOps, Incident Response, and Risk teams to improve threat detection, strengthen cloud security controls, and protect critical business systems and data.

Additional Information*

The base salary for this position will vary based on geography and other factors. In accordance with law, the base salary for this role if filled within New York, NY is $110k - $125k/year & benefits (see below).

Key Responsibilities

• Conduct proactive threat hunting across AWS accounts, workloads, identities, networks, and applications.
• Investigate suspicious activity, anomalous behavior, unauthorized access, privilege escalation, data exfiltration, and other potential security incidents.
• Analyze logs and telemetry from AWS and enterprise security tools to identify indicators of compromise and attack techniques.
• Develop and maintain threat-hunting hypotheses based on current intelligence, adversary tactics, vulnerabilities, and emerging attack trends.
• Use the MITRE ATT&CK framework, AWS security best practices, and cloud attack models to guide investigations and detection improvements.
• Monitor and analyze AWS services and security telemetry, including:
• AWS CloudTrail
• Amazon GuardDuty
• AWS Security Hub
• Amazon Detective
• VPC Flow Logs
• Route 53 Resolver DNS query logs
• Amazon CloudWatch
• AWS Config
• IAM activity and authentication logs
• S3 access and data events
• Investigate activity involving EC2, S3, IAM, Lambda, RDS, ECS/EKS, VPC, API Gateway, and other AWS services.
• Develop, tune, and validate detection rules, alerts, correlation logic, and threat-hunting queries.
• Support incident response activities, including triage, containment, evidence collection, root-cause analysis, and recovery.
• Perform forensic analysis of cloud logs, identity events, network traffic, endpoint data, and workload activity.
• Identify gaps in cloud visibility, logging, monitoring, access controls, and security configurations.
• Collaborate with Cloud Security and Engineering teams to remediate vulnerabilities and improve security architecture.
• Create playbooks, standard operating procedures, investigation guides, and incident reports.
• Track threat-hunting findings through remediation and validate that corrective actions are effective.
• Produce concise technical and executive-level reports on findings, risks, trends, and recommendations.
• Participate in incident response exercises, purple-team activities, tabletop exercises, and continuous security improvement initiatives.
• Stay current on cloud attack techniques, threat actor behavior, vulnerabilities, malware, and security research relevant to AWS environments.
• Participate in an on-call or incident-response rotation, where required.

Required Qualifications

• Overall 8+ years of IT experience is required
• 3+ years of experience in cybersecurity, threat hunting, security operations, incident response, or cloud security.
• 2+ years of hands-on experience securing or investigating AWS cloud environments.
• Strong understanding of AWS security principles, identity and access management, cloud networking, logging, and monitoring.
• Experience analyzing AWS CloudTrail, VPC Flow Logs, GuardDuty findings, IAM events, DNS logs, and other cloud telemetry.
• Experience with SIEM, SOAR, EDR, XDR, or cloud-native security platforms.
• Experience developing queries, detections, dashboards, or analytics using tools such as Splunk, Microsoft Sentinel, Elastic, Chronicle, or similar platforms.
• Knowledge of threat-hunting methodologies, incident response, digital forensics, and security investigation techniques.
• Understanding of common attack techniques, including:
• Credential theft and abuse
• IAM privilege escalation
• Account takeover
• Persistence and lateral movement
• Cryptomining
• Web shells and malicious code execution
• Data exfiltration
• Misconfigured cloud resources
• Supply-chain and third-party compromise
• Familiarity with the MITRE ATT&CK framework and common cloud attack paths.
• Experience with scripting or automation using Python, PowerShell, Bash, or similar languages.
• Strong analytical, investigative, documentation, and problem-solving skills.
• Excellent written and verbal communication skills.
• Ability to work effectively in a fast-paced environment and manage multiple investigations or priorities.

Preferred Qualifications

• AWS Certified Security – Specialty.
• AWS Certified Solutions Architect or AWS Certified Cloud Practitioner.
• Certified Information Systems Security Professional ( CISSP ).
• GIAC certifications such as GCIH, GCIA, GCED, GNFA, GCFR, or GCTI.
• Certified Incident Handler ( ECIH ) or equivalent certification.
• Experience with AWS Organizations, Control Tower, Security Hub, GuardDuty, Detective, Macie, Inspector, and IAM Access Analyzer.
• Experience securing containers and orchestration platforms, including Docker and Amazon EKS/ECS.
• Experience with Kubernetes security and cloud-native application security.
• Knowledge of Infrastructure as Code security, including Terraform, CloudFormation, or AWS CDK.
• Familiarity with threat intelligence platforms, malware analysis, and adversary emulation.
• Experience creating detection content using Sigma, YARA, KQL, SPL, SQL, or similar query languages.
• Experience with cloud security posture management and cloud-native application protection platforms.
• Knowledge of compliance and security frameworks such as NIST, CIS AWS Foundations, ISO 27001, SOC 2, PCI DSS, HIPAA, or FedRAMP.
• Experience working in a Security Operations Center or Computer Security Incident Response Team.

We offer:

• A highly competitive compensation and benefits package.
• A multinational organization with 58 offices in 22 countries and the possibility to work abroad.
• 10 days of paid annual leave (plus sick leave and national holidays).
• Maternity & paternity leave plans.
• A comprehensive insurance plan including medical, dental, vision, life insurance, and long-/short-term disability (plans vary by region).
• Retirement savings plans.
• A higher education certification policy.
• Commuter benefits (varies by region).
• Extensive training opportunities, focused on skills, substantive knowledge, and personal development.
• On-demand Udemy for Business for all Synechron employees with free access to more than 5000 curated courses.
• Coaching opportunities with experienced colleagues from our Financial Innovation Labs (FinLabs) and Center of Excellences (CoE) groups.
• Cutting edge projects at the world’s leading tier-one banks, financial institutions and insurance firms.
• A flat and approachable organization.
• A truly diverse, fun-loving, and global work culture.

SYNECHRON’S DIVERSITY & INCLUSION STATEMENT

Diversity & Inclusion are fundamental to our culture, and Synechron is proud to be an equal opportunity workplace and is an affirmative action employer. Our Diversity, Equity, and Inclusion (DEI) initiative ‘Same Difference’ is committed to fostering an inclusive culture – promoting equality, diversity and an environment that is respectful to all. We strongly believe that a diverse workforce helps build stronger, successful businesses as a global company. We encourage applicants from across diverse backgrounds, race, ethnicities, religion, age, marital status, gender, sexual orientations, or disabilities to apply. We empower our global workforce by offering flexible workplace arrangements, mentoring, internal mobility, learning and development programs, and more.

All employment decisions at Synechron are based on business needs, job requirements and individual qualifications, without regard to the applicant’s gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law.