{"data":{"id":164266,"slug":"2-cyberforsvarsforbandet-soker-threat-hunt-specialist","type":"job","title":"2. Cyber Defense Unit Seeks Threat Hunt Specialist","description":"The Swedish Armed Forces (F\u00f6rsvarsmakten) is in an expansion phase and on a major growth journey. The Armed Forces' cyber defense is an integrated part of military defense and constitutes a military-strategic resource. Cyber defense has the capability to conduct offensive and defensive cyber operations as well as to detect, identify, and neutralize threats from the most sophisticated actors. The effects of a cyberattack can have consequences as severe for critical societal functions as a conventional armed attack.\n \nDo you want to protect Sweden and our right to live as we choose in a digitalized world?\nAttacks over the internet against computers and servers worldwide are increasing in scale. The effects of a cyberattack can have consequences as severe for critical societal functions as a conventional armed attack. The Armed Forces as an authority is in constant development, with our primary mission being to protect Sweden's inviolable freedom. We are prepared to do what is necessary, even in the most difficult times.\n2. Cyber Defense Unit is therefore now seeking a specialist in threat hunting. If you have an analytical mindset and have worked for several years with hypothesis-driven hunting of adversaries who have gained access to IT systems, this could be the role for you.\n \nMain Responsibilities\nWithin Cyber Defense, we always want to be at the forefront of innovation and through our actions contribute to a safer Sweden. In this role, you will have the opportunity to drive and develop cyber defense's capability for hypothesis-driven hunting. In the role, you will also contribute to the development of technical solutions to meet cyber defense's unique needs, which may include method, technology, and tool development. The tasks we face as a team must be solvable both in peace and in war, whereby physical training is a natural part of the work duties (the employer provides 3 hours per week of work time for physical training).\nAs a threat hunt specialist, your role includes working with:\nDevelopment of hypotheses to conduct proactive cybersecurity in designated IT systems.\nDevelopment and refinement of detection methods adapted for TTPs of various adversaries.\nImplementation, administration, and improvement of methods for hypothesis-driven hunting.\nMentoring of junior colleagues.\n\n Qualifications\nUniversity degree in IT or equivalent knowledge deemed relevant by the employer.\nDocumented work experience in a relevant field for at least 5 years.\nCategory B driver's license.\n\nMeritorious\nCompleted military basic training.\nExperience working with IT infrastructure, both in public and isolated environments.\nExperience in incident response work.\nKnowledge of and experience with CTI and detections.\nKnowledge of and experience working with NIST Special Publication 800-53.\nWell versed in MITRE ATT&CK.\n\n Skills within:\nHost-based forensics\nNetwork forensics\nMalware analysis\n\nPersonal Qualities\nWe see that you as an applicant have a high security awareness. We place great importance on qualities such as creativity and solution orientation. You are curious and keep yourself updated within your field of work. You work well in collaboration and value the strength of teamwork and working toward common goals. To thrive and be part of the team, you need to be unpretentious, have the drive to solve challenges with incomplete information, and to maintain Sweden's security.\n \nWhat We Offer You\nAn important and stimulating job where you contribute to Sweden's security. Within the Armed Forces' cyber defense, you are offered continuous professional development so you can advance in your role and gain the conditions necessary for you to succeed in your mission. The work also includes continuous basic military capability, as our personnel hold combatant status. Those lacking military basic training will undergo the Armed Forces' general military training (AMU) to obtain a basic understanding of military operations and personal skills. A workplace characterized by strong community and a major focus on work-life balance.\n \nOther Requirements\nYou should not tell other people (besides those directly concerned) that you have applied for a position at 2. Cyber Defense Unit. The reason we ask you to be discreet with this information is that there are positions at the unit that are covered by confidentiality. Employment with the Armed Forces requires Swedish citizenship. Employment entails national and international work obligations. The position has combatant status, which means you must be able to handle and use weapons. You will receive this training from us. A security clearance with record check will be conducted before employment. The selection process will be supplemented with occupational psychological tests.\nEmployment Type: Permanent employment, 6-month probationary period applies if you are not currently employed by the Armed Forces\nWork Location: Link\u00f6ping\nStart Date: By agreement\nFor more information about the position, feel free to contact us at: 2.cff-rekrytering@mil.se\nWelcome to submit your application by September 27. Your application must contain a CV and a cover letter describing how you meet our stated requirements. Submit your application to: 2.cff-rekrytering@mil.se, please include reference 22032 in your application. NOTE! The application instructions below are incorrect\u2014use the email address above.\n \nApplications for this position will only be accepted through the Armed Forces' website. ----------------------------------------------------- Information about the recruiting unit: At Headquarters are the Supreme Commander and Director General. Headquarters has approximately 1,000 employees\u2014both professional officers and civilian experts. As of January 1, 2023, Headquarters consists of the Defense Staff, the Operations Command, Military Intelligence and Security Service, and the Headquarters Staff Division and independent oversight units. Employment with us involves placement in a security classification. Swedish citizenship is typically required. A security clearance with record check will be conducted before employment in accordance with Chapter 3 of the Security Protection Act. Employment entails an obligation to be placed on war footing. Employment also includes an obligation to serve abroad. The scope of this varies depending on the type of position. A CV and cover letter must be attached to the employment application. If you advance in the hiring process, certified copies of grades and certificates must always be presented. Calls from external recruiting firms and salespeople are not welcome.","language":"sv","is_translated":true,"title_original":"2. Cyberf\u00f6rsvarsf\u00f6rbandet s\u00f6ker threat hunt specialist","description_original":"F\u00f6rsvarsmakten befinner sig i en expansionsfas och p\u00e5 en omfattande tillv\u00e4xtresa. F\u00f6rsvarsmaktens cyberf\u00f6rsvar ing\u00e5r som en integrerad del i det milit\u00e4ra f\u00f6rsvaret och utg\u00f6r en milit\u00e4rstrategisk resurs. Cyberf\u00f6rsvaret har f\u00f6rm\u00e5ga att genomf\u00f6ra offensiva och defensiva cyberoperationer samt att uppt\u00e4cka, identifiera och avv\u00e4rja hot fr\u00e5n de mest kvalificerade akt\u00f6rerna. Effekterna av en cyberattack kan f\u00e5 lika stora konsekvenser f\u00f6r samh\u00e4llsviktiga funktioner som ett konventionellt v\u00e4pnat angrepp.\n\u00a0\nVill du v\u00e4rna om Sverige och v\u00e5r r\u00e4tt att leva som vi sj\u00e4lva v\u00e4ljer i en digitaliserad v\u00e4rld?\n\u00d6ver internet sker attacker mot datorer och servrar v\u00e4rlden \u00f6ver i en allt st\u00f6rre omfattning. Effekterna av en cyberattack kan f\u00e5 lika stora konsekvenser f\u00f6r samh\u00e4llsviktiga funktioner som ett konventionellt v\u00e4pnat angrepp. F\u00f6rsvarsmakten som myndighet \u00e4r i st\u00e4ndig utveckling, d\u00e4r v\u00e5r huvudsakliga uppgift \u00e4r att v\u00e4rna om Sveriges okr\u00e4nkbara frihet. Vi \u00e4r beredda att g\u00f6ra det som kr\u00e4vs, \u00e4ven i de sv\u00e5raste av stunder.\n2. Cyberf\u00f6rsvarsf\u00f6rbandet s\u00f6ker d\u00e4rf\u00f6r nu en specialist inom threat hunt. Har du ett analytiskt sinnelag och har arbetat flera \u00e5r med hypotesdriven jakt efter antagonister som tagit sig in i IT-system, d\u00e5 kan detta vara n\u00e5got f\u00f6r dig.\n\u00a0\nHuvudsakliga arbetsuppgifter\nInom Cyberf\u00f6rsvaret vill vi alltid vara i framkant av innovation och genom v\u00e5rt agerande bidra till ett s\u00e4krare Sverige. I denna roll f\u00e5r du m\u00f6jlighet att driva och utveckla cyberf\u00f6rsvarets f\u00f6rm\u00e5ga till hypotesdriven jakt. I rollen f\u00e5r du \u00e4ven bidra till framtagning av tekniska l\u00f6sningar f\u00f6r att m\u00f6ta cyberf\u00f6rsvarets unika behov, vilket kan inneb\u00e4ra metod-, teknik-, verktygsutveckling.\u00a0Uppgifterna vi som team st\u00e4lls inf\u00f6r ska kunna l\u00f6sas b\u00e5de i fred som krig, varp\u00e5 fysisk tr\u00e4ning \u00e4r en naturlig del av arbetsuppgiften (arbetsgivaren tillhandah\u00e5ller arbetstid om 3 timmar i veckan f\u00f6r fysisk tr\u00e4ning).\nI rollen som threat hunt-specialist ing\u00e5r att arbeta med:\nFramtagning av hypoteser f\u00f6r att kunna bedriva proaktiv cybers\u00e4kerhet i utpekade IT-system.\nFramtagning och utveckling av detektionsmetoder anpassade f\u00f6r TTP:er hos olika antagonister.\nImplementering, administrering och f\u00f6rb\u00e4ttring av metoder f\u00f6r hypotesdriven jakt.\u00a0\nHandledning av juniora medabetare.\n\n\u00a0Kvalifikationer\nH\u00f6gskoleutbildning inom IT eller motsvarande kunskap som arbetsgivaren finner relevant.\nDokumenterad arbetslivserfarenhet inom relevant arbetsomr\u00e5de om minst 5 \u00e5r.\nB-k\u00f6rkort.\n\nMeriterande\nGenomf\u00f6rd milit\u00e4r grundutbildning.\nErfarenhet av arbete med IT-infrastruktur, s\u00e5v\u00e4l publika som isolerade milj\u00f6er.\nErfarenhet utav arbete inom incident response.\nKunskap om och erfarenhet utav CTI och detektioner.\nKunskap om och erfarenhet i att arbeta med NIST Special Publication 800-53.\nV\u00e4l f\u00f6rtrogen av MITRE ATT&CK.\n\n\u00a0F\u00e4rdigheter inom:\nHostbaserad forensik\nN\u00e4tverksforensik\nMalwareanalys\n\nPersonliga egenskaper\nVi ser att du som s\u00f6ker har ett h\u00f6gt s\u00e4kerhetsmedvetande. Vi l\u00e4gger stor vikt vid att du som s\u00f6ker har egenskaper s\u00e5 som kreativitet, l\u00f6sningsorienterad. Du \u00e4r vetgirig och h\u00e5ller dig uppdaterad inom ditt arbetsomr\u00e5de. Du har l\u00e4tt f\u00f6r att samarbeta och v\u00e4rdes\u00e4tter styrkan i att arbeta som ett lag och mot gemensammam\u00e5l. F\u00f6r att trivas och kunna vara en del av laget beh\u00f6ver du vara prestigel\u00f6s, ha drivet att l\u00f6sa utmaningar p\u00e5 ofullst\u00e4ndig information, och att uppr\u00e4tth\u00e5lla Sveriges s\u00e4kerhet.\u00a0\nVad vi erbjuder dig\nEtt viktigt och stimulerande arbete d\u00e4r du bidrar till Sveriges s\u00e4kerhet. Inom F\u00f6rsvarsmaktens cyberf\u00f6rsvar erbjuds du kontinuerlig kompetensutveckling s\u00e5 att du kan vidareutvecklas i din roll och f\u00e5 de f\u00f6ruts\u00e4ttningar som kr\u00e4vs f\u00f6r att du ska lyckas med ditt uppdrag. Arbetet innefattar \u00e4ven kontinuerlig grundl\u00e4ggande milit\u00e4rf\u00f6rm\u00e5ga, d\u00e5 v\u00e5r personal innehar kombattantstatus. Den som saknar milit\u00e4r grundutbildning kommer att genomg\u00e5 F\u00f6rsvarsmaktens allm\u00e4nna milit\u00e4ra utbildning (AMU) i syfte att erh\u00e5lla grundf\u00f6rst\u00e5else f\u00f6r milit\u00e4r verksamhet och personlig f\u00e4rdighet. En arbetsplats som pr\u00e4glas av stark gemenskap och har stort fokus p\u00e5 balans mellan arbete och privatliv.\u00a0\n\u00a0\n\u00d6vriga krav\nDu b\u00f6r inte ber\u00e4tta att du s\u00f6kt tj\u00e4nst hos 2. Cyberf\u00f6rsvarsf\u00f6rbandet f\u00f6r andra personer \u00e4n dina n\u00e4rmast ber\u00f6rda. Anledningen till att vi ber dig vara \u00e5terh\u00e5llsam med informationen \u00e4r att det finns tj\u00e4nster vid f\u00f6rbandet som omfattas av sekretess. F\u00f6r anst\u00e4llning vid F\u00f6rsvarsmakten kr\u00e4vs svenskt medborgarskap. Med anst\u00e4llning f\u00f6ljer nationell och internationell arbetsskyldighet. Tj\u00e4nsten har kombattantstatus vilket inneb\u00e4r att du skall kunna hantera och bruka vapen. Denna utbildning f\u00e5r du hos oss. En s\u00e4kerhetspr\u00f6vning med registerkontroll kommer att genomf\u00f6ras f\u00f6re anst\u00e4llning. Urvalsprocessen kommer att kompletteras med arbetspsykologiska tester.\nAnst\u00e4llningsform: Tillsvidareanst\u00e4llning, 6 m\u00e5naders provanst\u00e4llning till\u00e4mpas f\u00f6r dig som f\u00f6r n\u00e4rvarande inte \u00e4r anst\u00e4lld inom F\u00f6rsvarsmakten\nPlaceringsort: Link\u00f6ping\nTilltr\u00e4de: Enligt \u00f6verenskommelse\nVill du veta mer om tj\u00e4nsten \u00e4r du v\u00e4lkommen att kontakta oss p\u00e5: 2.cff-rekrytering@mil.se\nV\u00e4lkommen in med din ans\u00f6kan senast 27 september. Din ans\u00f6kan skall inneh\u00e5lla CV samt ett personligt brev d\u00e4r du beskriver p\u00e5 vilket s\u00e4tt du uppfyller v\u00e5ra efterfr\u00e5gade krav. Ans\u00f6kan skickas till: 2.cff-rekrytering@mil.se, ange referens 22032. p\u00e5 din\n\u00a0\nans\u00f6kan. OBS! Ans\u00f6kningsanvisningen nedan \u00e4r felaktig anv\u00e4nd mailen\n\u00a0\n\u00a0Ans\u00f6kningar till denna befattning kommer endast tas emot via F\u00f6rsvarsmaktens webbplats.\u00a0 ----------------------------------------------------- Information om det rekryterande f\u00f6rbandet: I H\u00f6gkvarteret finns \u00f6verbef\u00e4lhavaren och generaldirekt\u00f6ren. H\u00f6gkvarteret har ungef\u00e4r 1 000 medarbetare \u2013 b\u00e5de yrkesofficerare och civila experter. H\u00f6gkvarteret utg\u00f6rs fr\u00e5n 2023-01-01 av f\u00f6rsvarsstaben, operationsledningen, milit\u00e4ra underr\u00e4ttelse- och s\u00e4kerhetstj\u00e4nsten, samt H\u00f6gkvarterets stabsavdelning och frist\u00e5ende enheter f\u00f6r tillsyn. En anst\u00e4llning hos oss inneb\u00e4r placering i s\u00e4kerhetsklass. Vanligtvis kr\u00e4vs svenskt medborgarskap. S\u00e4kerhetspr\u00f6vning med registerkontroll kommer att genomf\u00f6ras f\u00f6re anst\u00e4llning enligt 3 kap i s\u00e4kerhetsskyddslagen. Med anst\u00e4llning f\u00f6ljer en skyldighet att krigsplaceras. I anst\u00e4llningen ing\u00e5r \u00e4ven en skyldighet att tj\u00e4nstg\u00f6ra utomlands. Inneb\u00f6rden av detta varierar beroende p\u00e5 typ av befattning. Till ans\u00f6kan om anst\u00e4llning ska CV och personligt brev bifogas. Om du g\u00e5r vidare i anst\u00e4llningsprocessen ska alltid vidimerade kopior av betyg och intyg uppvisas. Samtal fr\u00e5n externa rekryteringsf\u00f6retag och s\u00e4ljare undanbedes.","price":null,"currency":"SEK","status":"active","noindex":true,"location":{"address":null,"full_address":null,"city":"Link\u00f6ping","country":"SE","latitude":58.405681374135,"longitude":15.513919462462},"metadata":{"region":"\u00d6sterg\u00f6tlands l\u00e4n","duration":"Tills vidare","employer":"F\u00d6RSVARSMAKTEN","postcode":"58663","positions":1,"profession":"Dataoperat\u00f6r","salary_type":"Fast m\u00e5nads- vecko- eller timl\u00f6n","employer_url":"https:\/\/www.forsvarsmakten.se\/","scope_of_work":"100\u2013100 %","working_hours":"Heltid","driving_license":true,"employment_type":"Vanlig anst\u00e4llning","occupation_field":"Data\/IT","employer_workplace":"F\u00f6rsvarsmakten","translation_status":"done","experience_required":true},"user_id":null,"is_sponsored":false,"views_count":0,"ai_views_count":2,"ai_vendor_counts":{"anthropic":2},"visibility":"public","submission_source":null,"submission_ai_name":null,"has_owner_email":true,"can_contact_owner":true,"phone":null,"owner_email":"2.cff-rekrytering@mil.se","images":[],"published_at":"2026-08-20T08:42:36+00:00","expires_at":"2026-09-27T23:59:59+00:00","created_at":"2026-08-21T03:18:34+00:00","updated_at":"2026-08-21T04:01:04+00:00"}}