Data Security Analyst II, Threat Hunter - Red Hat

City : Austin

State : Texas

Neos is Seeking a Data Security Analyst II (Threat Hunter, Red Hat) for a contract role for with our client in Austin, TX.

***HYBIRD (AUSTIN) or REMOTE - CANDIDATES CURRENTLY RESIDING IN THE AUSTIN, TEXAS AREA OR IN U.S. NEED APPLY***

No calls, no emails, please respond directly to the "apply" link with your resume and contact details.

This position is Remote, outside of Austin

Local candidates will be Hybrid - 1 day per week in office, Wednesdays

located at 5500 E. Oltorf ST, Austin, TX 78741

Job Description

Data Security Analyst II - Threat Hunter (Red Hat / Linux)

Department: IT Enterprise Information Security

Location: Remote (outside Austin) or Hybrid (Austin, TX - one day onsite per week)

Position Overview

Position Summary

The Office of Attorney General (OAG) is seeking a highly skilled Threat Hunter with extensive Red Hat / Linux security experience to support proactive threat identification across OAG's enterprise environment. This position will focus on analyzing security telemetry, investigating risk indicators, and conducting deep-dive threat hunting activities to determine whether suspicious behavior warrants escalation, containment, or policy updates.

The ideal candidate will combine hands-on investigative skill with ethical hacking / adversary simulation techniques to validate potential exposure paths and determine how an attacker could compromise systems. This individual will develop structured threat hunting playbooks and risk-based investigative procedures that can be operationalized and automated (in collaboration with Splunk/SIEM engineering resources).

Key Responsibilities
Proactively hunt for threats by analyzing security telemetry and risk indicators across OAG's enterprise environment, identifying suspicious activity, privilege misuse, persistence, and lateral movement.
Lead deep-dive investigations in Red Hat / Linux (RHEL) environments by reviewing system logs, authentication activity, services, binaries, scheduled tasks, and network behavior to validate potential compromise.
Partner with SIEM/Splunk engineering to implement and harden Copilot-driven Splunk workflows, including least-privilege access, secure data handling, logging/monitoring, and control validation to prevent data leakage or unintended exposure.
Triage and assess risk severity to determine whether findings require escalation, containment, deeper investigation, or immediate mitigation actions.
Conduct ethical hacking/adversary-based validation (within approved rules of engagement) to confirm exploitability, attack paths, and real-world impact to systems.
Develop structured and repeatable threat hunting playbooks (signals, validation steps, evidence required, escalation triggers, and mitigation actions) and translate findings into detection requirements.
Partner with SIEM/Splunk engineering to operationalize and automate playbooks into Splunk workflows, alerts, and response processes.
Recommend security control enhancements and policy updates based on investigation outcomes, and document findings in a clear, defensible format for leadership and technical teams.

Required Qualifications

• 6+ years of experience in threat hunting, incident response, or security investigations in a security enterprise environment.
• 6+ years of extensive hands-on experience with Red Hat / Linux security (RHEL preferred).
• 3+ years experience supporting environments that include hybrid infrastructure (cloud + on-prem).
• 1+ years experience enabling and securing AI-driven SOC workflows, including Microsoft Copilot integration with SIEM platforms (Splunk preferred), with a focus on least-privilege access, data governance, auditability, and secure implementation patterns.
• Proven ability to analyze system-level telemetry and determine real risk vs noise.
• Strong experience performing deep investigative analysis and making escalation recommendations.
• Demonstrated experience with ethical hacking / adversary simulation and understanding how compromise occurs.
• Ability to develop structured playbooks and investigative procedures for repeatable threat hunting.
• Experience partnering with SIEM/Splunk teams to operationalize detection logic and automation.
• Familiarity with common attacker techniques (MITRE ATT&CK mapping experience preferred).
• Certifications are a plus (examples: Security+, CEH, OSCP, GIAC), but hands-on capability matters most.

#DICE

#LI-MB