Threat Hunter

About the Role

We are seeking a highly analytical, proactive, and technically skilled Threat Hunting Analyst to join our Cyber Security team. In this role, you will move beyond reactive alert monitoring to actively track down hidden adversaries, advanced persistent threats (APTs), and other techniques within the enterprise footprint and infrastructure. You will perform structured, hypothesis-driven threat hunting campaigns utilizing our core enterprise security stack, specifically in SIEM/EDR and Threat Intelligence. This individual must possess deep tactical knowledge of adversary behaviors, exceptional log decoding capabilities, and a baseline skill set in detection engineering to convert hunting discoveries into permanent, high-fidelity security alerts.

Key Responsibilities

• Proactive Threat Hunting: Design, formulate, and execute structured, hypothesis-driven threat hunting campaigns across endpoints, identity providers, network telemetry, and cloud environments.
• Hypothesis Generation & Scenario Modeling: Develop testable, environment-specific hunting hypotheses by translating threat intelligence briefs and known attacker behaviors into targeted queries, focusing on uncovering anomalies rather than relying on static alerts.
• Adversary Mapping: Uncover stealthy or zero-day malicious activities, mapping all discoveries directly to the MITRE ATT&CK framework to identify visibility gaps.
• Advanced Query Engineering: Author, tune, and optimize custom detection rules and complex threat hunting queries using YARA-L 2.0 and Google SecOps Universal Data Model (UDM) search.
• Endpoint Telemetry Deep-Dives: Utilize Query Languages and Advanced Event Search within XDR to decode raw endpoint telemetry and reconstruct host timelines during active investigations.
• Threat Intelligence Enrichment: Leverage Threat Intelligence to dynamically enrich host investigations, validate malware behavior, and pivot from Indicators of Compromise (IOCs/IOAs) into broader attacker infrastructure. Consume and analyze tactical/strategic threat intelligence to understand the latest Tactics, Techniques, and Procedures (TTPs) of relevant threat actors.

Requirements & Tech Stack

• SIEM
• EDR
• Threat Intelligence
• YARA-L 2.0
• Google SecOps Universal Data Model (UDM)
• XDR
• MITRE ATT&CK framework
• Endpoint Telemetry
• Identity Providers
• Network Telemetry
• Cloud Environments