---
title: 'Threat Hunter/Purple Team Operator at SixGen, Inc.'
canonical: 'https://feeny.ai/job/threat-hunter-purple-team-operator-sixgen-inc-remote-ae086bkajcxq'
type: 'job'
last_seen: '2026-10-26'
---

# Threat Hunter/Purple Team Operator at SixGen, Inc.

- **Company:** SixGen, Inc.
- **Location:** Remote
- **Work type:** remote
- **Posted:** 2026-10-10
- **Last confirmed live:** 2026-10-26
- **Apply:** https://job-boards.greenhouse.io/sixgeninc/jobs/5449675008

## Job description

Threat Hunter / Purple Team Operator

SIXGEN's mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and leading technical capabilities to uncover vulnerabilities, protect vital systems, and strengthen operational resilience.

## POSITION OVERVIEW

- Position: Mid-Level Threat Hunter / Purple Team Operator
- Job Type: Full Time
- Location: Remote with travel to customers and test locations as required
- Clearance Requirement: Active Top Secret with SCI eligibility
- Salary Range; $115-$140K

## WHAT YOU'LL DO

SIXGEN is seeking a mid-level Threat Hunter / Purple Team Operator to  identify threats that evade existing detection methods, develop and test hunting hypotheses, and feed findings back into detection engineering. This role will combine remote threat hunting and on-site purple team coordination in direct support of red team engagements to secure systems, strengthen the defenders, and build and validate detection methods that can catch offensive traffic in real time.

This role requires comfort working independently through remote hunts as well as the ability to translate adversary tradecraft into defensive guidance.

Responsibilities include:

- Conduct hypothesis-driven and intelligence-led threat hunts across endpoints, networks, and cloud telemetry for several weeks prior to each red team engagement.
- Analyze logs, alerts, and historical data for indicators of compromise (IOCs), anomalous behavior, and adversary TTPs mapped to the MITRE ATT&CK from partner-provided sources (EDR, SIEM, authentication/identify logs).
- Document hunt coverage and methodology, findings, detection recommendations, and any confirmed or suspected compromise, escalating immediately if active adversary activity is found.
- Deliver a threat hunt summary and determine if the customer environment is clear prior to red team assessments.
- Partner with blue teams during the purple portion of the engagement to assist in detecting, tuning, and validating controls against red team TTPs in real-time.
- Brief technical and non-technical stakeholders on hunt result and purple team detection outcomes.
- Serve as a Trusted Agent during the red team assessment and maintain strict confidentiality and operational security with insight into both red and blue team activity.

Technology proficiency includes:

- SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic).
- EDR/XDR tooling (e.g. CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Carbon Black).
- Network detection and traffic analysis tools (e.g. Zeek, Suricata, full packet capture).
- Log aggregation and correlation across endpoint, network, cloud, and identity sources (e.g., Azure AD/Entra ID, AWS CloudTrail, Microsoft 365).
- MITRE ATT&CK framework for mapping hunts and detections to adversary TTPs.
- Query and scripting languages for hunting and automation (e.g. KQL, SPL, Python).
- Familiarity with common red team tooling and tradecraft (e.g., Cobalt Strike, Havoc, and other C2 traffic patterns) to help recognize and detect it.

## WHAT YOU BRING

Required qualifications:

- 3 – 5+ years of experience in threat hunting, SOC/detection engineering, incident response, or a closely related defensive security role.
- Hand-on experience working with a major SIEM and EDR platform.
- Working knowledge of the MITRE ATT&CK framework and how to map observed activity to adversary TTPs.
- Understanding of common adversary tradecraft and red team testing methodology to help close detection gaps.
- Strong written and verbal communication skills with the ability to produce clear, customer-facing findings and an “all clear” determination.
- Comfortable operating independently in remote, customer-facing roles.
- U.S. citizenship, with eligibility to obtain and maintain a U.S. government security clearance.

Preferred qualifications:

- Industry certifications such as GCFA, GCIH, GNFA, GCTI, CySA+, or equivalent.
- Prior experience performing threat hunting and/or purple team role working directly alongside a red team.
- Scripting and automation experience to streamline hunting workflows (e.g., Python, PowerShell).
- Prior experience working with multiple partner organizations or client environments.
- Active TS/SCI clearance.

## COMPENSATION AND BENEFITS

SIXGEN offers competitive compensation based on the responsibilities of the role and the candidate's experience, qualifications, specialized expertise, and security-clearance status. The final compensation package will be discussed during the hiring process.

SIXGEN offers benefits for full-time employees, including:

- Employer-paid health insurance premiums, including medical, dental, and vision coverage, for employees and their families
- Employer-paid short- and long-term disability insurance and basic life and AD&D insurance
- 401(k) plan with a 4% employer contribution
- Professional-development reimbursement options for training, certifications, and education
- Flexible and remote-work policies for most positions
- Flexible paid time off and holiday schedule

For more information, please contact Human Strategist Amy Maxwell at amy.maxwell@sixgen.io.

## OUR COMMITMENT

SIXGEN is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, marital status, ancestry, protected veteran status, or any other characteristic protected by applicable law.

We are committed to fostering an inclusive culture that values diversity in our people and reflects the communities and customers we serve. We strive to attract and retain a diverse talent pool and to create an environment where everyone is empowered to do their best work.

## About SixGen, Inc.

## Company Overview
- **One-liner**: SIXGEN is a cybersecurity company that provides mission-aligned cyber capabilities, tools, and operations to protect government, defense, and critical infrastructure organizations from global adversaries.
- **Entity Type**: Private (acquired by Washington Harbour Partners in November 2023)
- **Headquarters**: Annapolis, Maryland, United States
- **Founded**: 2014
- **Founders**: Ethan Dietrich

## Core Business
- **Primary industry/industries**: Cybersecurity, Defense & Aerospace, Critical Infrastructure Protection
- **Target customers**: Government agencies (U.S. and allied), Defense & Aerospace contractors, Energy & Utilities, Telecommunications, Commercial Enterprises, and other Critical Infrastructure sectors (B2B, B2G)
- **Mission or purpose statement**: To reveal threats, secure operations, and empower missions. They provide the tools, automation, insights, and tradecraft needed to adapt and operate in constantly shifting threat environments with a focus on the purposeful integration of machine speed and human expertise. [sixgen.io](https://www.sixgen.io/)

## Products & Services
- **Cyber Operations Services**: Highly skilled operators conduct research, assessments, and red team operations based on real-world threats, emulating global adversaries to report detailed and actionable findings on critical assets and infrastructures.
- **Applied Research, Reverse Engineering, & RF Development**: Services that involve deep technical analysis and tool development to uncover vulnerabilities and solve complex cyber challenges.
- **Cyber Training**: Train operators to execute across the full spectrum of cyber operations.
- **Automation, AI & Data Science**: Building tools that integrate machine speed with human expertise for threat detection, data security, and scalable growth-oriented solutions.
- **Infrastructure Security**: Services focused on IT/OT visibility, proactive mitigation, automated compliance, and unified visibility for legacy and modern systems.

## Market Standing
- **Valuation/Market Cap**: Not publicly available (acquired, so no public market cap)
- **Key Metric**: Annual Revenue of **$15.3 million** | Total Funding: **$500,000** (Seed round in 2017)
- **Notable Investors/Partners**: Parent company is **Washington Harbour Partners LP** (acquired in Nov 2023). Previously acquired **Fourcast Management and Analysis** (July 2022). Board member includes **Stu Shea**.
- **Growth Signals**: 
  - Year-over-year headcount growth of **+11.7%** (currently approximately 80 employees).
  - Active job postings have increased **+87.5% year-over-year**.
  - Expanded into the United Kingdom.
  - Secured by a private equity backer, providing capital for further expansion.

## Competitive Advantages
- **Deep Government & Defense Ties**: A large portion of their workforce comes from elite government and military backgrounds (NSA, US Air Force, US Army, US Marine Corps).
- **Mission-Focused Approach**: They position themselves as a “non-traditional defense contractor” that combines innovation with deep expertise rather than bureaucratic processes.
- **Proven Track Record of Acquisitions**: The acquisition of Fourcast Management and Analysis shows their ability to integrate new capabilities and grow through M&A.
- **Full-Spectrum Cyber Operations**: They cover the entire range from offensive cyber (CNO, CNE, Red Teaming) to defensive and intelligence operations.

## Strategic Focus
- **Post-Acquisition Growth**: Under Washington Harbour Partners, the company is aggressively hiring (87.5% more job postings year-over-year) and expanding its market reach.
- **Space & Emerging Domains**: Actively hiring for roles like "Senior Intelligence & Cyber Analyst – Space Systems," indicating a push into securing space-based infrastructure.
- **Purposeful AI Integration**: Focused on integrating AI and data science not for its own sake, but to solve specific operational challenges in threat detection and automation.
- **Industry Diversification**: While rooted in defense, they are growing their commercial offerings in energy, utilities, and telecommunications.

## Why Work Here
- **Meaningful Mission**: Employees work on “missions that matter” involving national security and critical infrastructure protection against real-world adversaries.
- **Comprehensive Benefits**: 
  - **Health**: 100% paid health, dental, and vision premiums for employees and family. HRA funds up to $3,000. Coverage starts on day one.
  - **Financial**: 4% direct employer 401(k) contribution regardless of employee participation. Short/long-term disability and basic life/AD&D insurance (3x salary up to $300k).
  - **Time Off**: Flexible time off and paid holidays. Flex time allows for work-life balance across pay periods.
  - **Leave**: Parental leave, jury duty, military leave, and voting leave.
- **Professional Development**: Support for training, certifications, and conferences (DEF CON, IITSEC, etc.).
- **Culture**: Described as valuing innovation, integrity, and purpose. High percentage of technical staff (38%).
- **Work Model**: Mix of on-site (Fort Meade, Annapolis, Reston, Sterling, Huntsville, Columbia), hybrid (DMV Area), and some remote roles.
- **Compensation**: Competitive salaries; example ranges from LinkedIn data: Software Engineer ~$121,945/year, Offensive Cyber Operator ~$92,363/year.

## Sources
1. [sixgen.io](https://www.sixgen.io/)
2. [Greenhouse Jobs at SixGen, Inc.](http://job-boards.greenhouse.io/sixgeninc)
3. [SIXGEN Careers Page](https://www.sixgen.io/careers)
4. [LinkedIn Company Page - SIXGEN](https://www.linkedin.com/company/sixgenio)
5. [Tracxn Company Profile - SIXGEN](https://tracxn.com/d/companies/sixgen/__A6y0Vd77YhuDDhLrOmjxwRZ5q2qK4dqrOLR876uKVQk)

## Other roles at SixGen, Inc.

- [Reverse Engineer](https://feeny.ai/job/reverse-engineer-sixgen-inc-arlington-z4js9qvdy85y) — Arlington, VA
- [Platform Devops Engineer-TS/SCI & CI POLY](https://feeny.ai/job/platform-devops-engineer-ts-sci-ci-poly-sixgen-inc-columbia-ptna9cqzyrbv) — Columbia, MD
- [AI/ML Engineer-TS/SCI  & CI POLY](https://feeny.ai/job/ai-ml-engineer-ts-sci-ci-poly-sixgen-inc-columbia-m9vd24ettw6x) — Columbia, MD
- [Reverse Engineer](https://feeny.ai/job/reverse-engineer-sixgen-inc-sterling-5qn6hq1z9zad) — Sterling, VA
- [Red Team Operator and Infrastructure SME](https://feeny.ai/job/red-team-operator-and-infrastructure-sme-sixgen-inc-1jmjd9t9d7am)
- [IT Specialist (TS Required)](https://feeny.ai/job/it-specialist-ts-required-sixgen-inc-sterling-es0hawa4r9da) — Sterling, VA
- [Senior Malware Analyst (Media, Malware, and Analysis – MMA) MD TS/SCI CI POLY](https://feeny.ai/job/senior-malware-analyst-media-malware-and-analysis-mma-md-ts-sci-ci-poly-sixgen-xswbcg9zt0xf) — Ft Meade, MD
- [Senior Cost Estimator/Analyst-TS/SCI & Poly](https://feeny.ai/job/senior-cost-estimator-analyst-ts-sci-poly-sixgen-inc-annapolis-junction-qsnwzxget7j5) — Annapolis Junction, MD
- [Senior CNO Developer](https://feeny.ai/job/senior-cno-developer-sixgen-inc-annapolis-junction-m9n8g5r8dtbp) — Annapolis Junction, MD
- [Data Scientist (TS/SCI w/ Poly)](https://feeny.ai/job/data-scientist-ts-sci-w-poly-sixgen-inc-columbia-nq149a5cp5c1) — Columbia, MD