Cloud Threat Hunter (Cyber)

We are At Synechron, we believe in the power of digital to transform businesses for the better. Our global consulting firm combines creativity and innovative technology to deliver industry-leading digital solutions. Synechron's progressive technologies and optimization strategies span end-to-end Artificial Intelligence, Consulting, Digital, Cloud & DevOps, Data, and Software Engineering, servicing an array of noteworthy financial services and technology firms. Through research and development initiatives in our FinLabs we develop solutions for modernization, from Artificial Intelligence and Blockchain to Data Science models, Digital Underwriting, mobile-first applications and more. We are seeking an experienced AWS Cloud Threat Hunter / Cybersecurity Analyst to identify, investigate, and respond to advanced cyber threats across AWS cloud environments. This role will proactively search for indicators of compromise, suspicious activity, attack patterns, and emerging threats across cloud infrastructure, identities, applications, and workloads. The successful candidate will work closely with Security Operations, Cloud Engineering, Infrastructure, DevOps, Incident Response, and Risk teams to improve threat detection, strengthen cloud security controls, and protect critical business systems and data.

Conduct proactive threat hunting across AWS accounts, workloads, identities, networks, and applications. Investigate suspicious activity, anomalous behavior, unauthorized access, privilege escalation, data exfiltration, and other potential security incidents. Analyze logs and telemetry from AWS and enterprise security tools to identify indicators of compromise and attack techniques. Develop and maintain threat-hunting hypotheses based on current intelligence, adversary tactics, vulnerabilities, and emerging attack trends. Use the MITRE ATT&CK framework, AWS security best practices, and cloud attack models to guide investigations and detection improvements. Monitor and analyze AWS services and security telemetry, including: AWS CloudTrail AWS Security Hub AWS Config S3 access and data events Investigate activity involving EC2, S3, IAM, Lambda, RDS, ECS/EKS, VPC, API Gateway, and other AWS services. Support incident response activities, including triage, containment, evidence collection, root-cause analysis, and recovery. Perform forensic analysis of cloud logs, identity events, network traffic, endpoint data, and workload activity. Identify gaps in cloud visibility, logging, monitoring, access controls, and security configurations. Collaborate with Cloud Security and Engineering teams to remediate vulnerabilities and improve security architecture. Produce concise technical and executive-level reports on findings, risks, trends, and recommendations. Stay current on cloud attack techniques, threat actor behavior, vulnerabilities, malware, and security research relevant to AWS environments. Participate in an on-call or incident-response rotation, where required.

3+ years of experience in cybersecurity, threat hunting, security operations, incident response, or cloud security.

2+ years of hands-on experience securing or investigating AWS cloud environments.

Strong understanding of AWS security principles, identity and access management, cloud networking, logging, and monitoring.

Experience analyzing AWS CloudTrail, VPC Flow Logs, GuardDuty findings, IAM events, DNS logs, and other cloud telemetry.

Experience with SIEM, SOAR, EDR, XDR, or cloud-native security platforms.

Experience developing queries, detections, dashboards, or analytics using tools such as Splunk, Microsoft Sentinel, Elastic, Chronicle, or similar platforms.

Knowledge of threat-hunting methodologies, incident response, digital forensics, and security investigation techniques.

Account takeover

Web shells and malicious code execution

Data exfiltration

Misconfigured cloud resources

Familiarity with the MITRE ATT&CK framework and common cloud attack paths.

Experience with scripting or automation using Python, PowerShell, Bash, or similar languages.

AWS Certified Security – Specialty.

AWS Certified Solutions Architect or AWS Certified Cloud Practitioner. Certified Information Systems Security Professional ( CISSP ). Experience with AWS Organizations, Control Tower, Security Hub, GuardDuty, Detective, Macie, Inspector, and IAM Access Analyzer. Experience securing containers and orchestration platforms, including Docker and Amazon EKS/ECS. Experience with Kubernetes security and cloud-native application security. Knowledge of Infrastructure as Code security, including Terraform, CloudFormation, or AWS CDK. Familiarity with threat intelligence platforms, malware analysis, and adversary emulation. Experience creating detection content using Sigma, YARA, KQL, SPL, SQL, or similar query languages. Experience with cloud security posture management and cloud-native application protection platforms. Knowledge of compliance and security frameworks such as NIST, CIS AWS Foundations, ISO 27001, SOC 2, PCI DSS, HIPAA, or FedRAMP. Experience working in a Security Operations Center or Computer Security Incident Response Team.

10 days of paid annual leave (plus sick leave and national holidays).

A comprehensive insurance plan including medical, dental, vision, life insurance, and long-/short-term disability (plans vary by region).

Retirement savings plans.

A higher education certification policy.

Extensive training opportunities, focused on skills, substantive knowledge, and personal development.

Coaching opportunities with experienced colleagues from our Financial Innovation Labs (FinLabs) and Center of Excellences (CoE) groups.

Cutting edge projects at the world's leading tier-one banks, financial institutions and insurance firms.

SYNECHRON'S DIVERSITY & INCLUSION STATEMENT

Diversity & Inclusion are fundamental to our culture, and Synechron is proud to be an equal opportunity workplace and is an affirmative action employer. Our Diversity, Equity, and Inclusion (DEI) initiative 'Same Difference' is committed to fostering an inclusive culture – promoting equality, diversity and an environment that is respectful to all. We strongly believe that a diverse workforce helps build stronger, successful businesses as a global company. We encourage applicants from across diverse backgrounds, race, ethnicities, religion, age, marital status, gender, sexual orientations, or disabilities to apply. We empower our global workforce by offering flexible workplace arrangements, mentoring, internal mobility, learning and development programs, and more.

All employment decisions at Synechron are based on business needs, job requirements and individual qualifications, without regard to the applicant's gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law.