Cyber Threat Hunter

About This Role

This role will proactively identify and investigate cyber threats across host, network, and cloud environments by analyzing adversary tools, techniques, and procedures (TTPs). The individual will also provide reactive investigative support during security incidents and contribute to various Security Operations and Incident Response processes.

Responsibilities

• Execute proactive threat hunting activities based on intelligence, telemetry, and hypotheses to identify malicious activity across host, network, and cloud environments.
• Develop and refine hunt queries, detections, and rules (Yara, Sigma) to support continuous improvement of detection engineering use cases.
• Monitor the evolving threat landscape, vulnerabilities, and adversary TTPs, applying this knowledge to enhance hunting strategies.
• Document hunting methodologies, queries, findings, and recommended actions in SOPs and playbooks aligned to MITRE ATT&CK.
• Participate in purple team exercises and adversary simulations to validate detection coverage and improve hunting techniques.
• Utilize SIEM, EDR, NDR, and UEBA tools to conduct hunts and confirm threats through forensic artifact analysis.
• Collaborate with incident response and forensic teams to share findings, assist in remediation, and strengthen detection capabilities.
• Contribute to automation efforts by developing scripts and workflows that reduce repetitive tasks and accelerate hunting operations.
• Support the maintenance of a hunt lab environment for testing hypotheses, validating detections, and experimenting with new tools and techniques.
• Be available outside of standard business hours occasionally to support time-sensitive or critical threat hunting activities.

Requirements

• 3-5 years of experience in cybersecurity with focus in Threat Hunting, Incident Response, Forensics, or Detection Engineering.
• Bachelor’s degree in cybersecurity, computer science, information technology, or related field.
• Hands-on experience with SIEM, EDR, NDR, and forensic tools, with ability to write hunt queries and detections.
• Working knowledge of MITRE ATT&CK and Cyber Kill Chain frameworks.
• Strong analytical and problem-solving skills.
• Experience with at least one scripting or programming language (Python, PowerShell, or JavaScript).
• Familiarity with cloud environments (AWS, Azure, GCP) and ability to conduct basic cloud-native hunting.
• Effective communication and documentation skills.

Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, or related field.
• 3-5 years of experience in cybersecurity with focus in Threat Hunting, Incident Response, Forensics, or Detection Engineering.

Skills

* Required skills

Certifications