Threat Expert

We are DXC – a Fortune 500 global IT services leader.

In Bulgaria, we are among the largest IT employers, delivering the full spectrum of the company’s diverse technical portfolio. Our teams work across cutting-edge technologies, contributing to projects that span industries and geographies.

We foster continuous learning and professional growth, offering access to targeted training and certifications aligned with individual interests and career aspirations.

Our culture of collaboration, innovation, and shared values empowers professionals to grow and succeed.

The Threat Expert is a core member of DXC's Security Operations Center, with primary responsibility for managing the threat landscape across DXC and its customers. This is achieved through the continuous cycle of cyber threat intelligence, proactive threat hunting, and detection rule content contribution — ensuring that emerging threats are identified, understood, and translated into defensive capability before they can cause harm.

A secondary but critical function of the role is to serve as a technical escalation resource during complex security incidents. The Threat Expert must communicate effectively with technical teams, customer stakeholders, and leadership throughout both the intelligence and incident lifecycle.

• Comfortable working in a customer-facing role, engaging stakeholders to capture requirements and present findings.

• Monitor and track threats, campaigns, and emerging threats across open, commercial, and closed sources relevant to DXC and its customers.

• Identify intelligence gaps and drive continuous improvement of Threat Management processes, tools, and methodologies.

• Maintain and operate Threat Intelligence platforms as part of the wider SOC toolset

• Lead hypothesis-driven threat hunts based on CTI and MITRE ATT&CK TTPs; maintain a hunt playbook library and document findings with actionable outcomes.

• Produce threat intelligence and threat hunting reports tailored to audiences from tactical findings for SOC teams to operational and strategic assessments for customer stakeholders and leadership.

• Contribute to detection rules and content creation, translating hunt findings and intelligence into SIEM and EDR detections.

• Support security operations teams during investigations and incident response activities and continuous improvement of Threat Management processes, tools, and methodologies.

• Degree/Diploma in Computer Science, Computer Engineering, Cyber Defense, Computer Forensics, Management Information Systems or equivalent information security industry recognized certifications (ISC2, ISACA, CCNA, CCNP, SNIA, SANS, CompTIA, MCP, MCSE).

• Minimum of 2-3 years’ hands-on technical knowledge of the applicable technology platform: SIEM, EDR, Threat Intelligence Platforms.

• Working knowledge of MITRE ATT&CK, Diamond Model, and the Cyber Kill Chain.

• Fluent in written and verbal English.

• Troubleshooting and problem-solving skills.

• Security certification, Intrusion Detection System, Proxy Support, Security Client Support, Security Devices Administration, Security Server Compliance Monitoring & Reporting, Security Training, Wireshark, Linux, SIEM and XDR tools such as MS Sentinel, ArcSight, Splunk, SumoLogic, MS Defenders, CrowdStrike, Carbon Black, 7AI.