Lead Threat Hunter

Role overview Lead proactive, intelligence-led investigations across enterprise, cloud, identity, and operational technology environments. The role turns evidence of emerging or overlooked attacker behavior into lasting detections, while helping reduce exposure and shorten the time adversaries can remain undetected.

Responsibilities - Plan and run threat hunts from initial hypothesis through evidence-based reporting, using established adversary behavior frameworks. - Analyze large volumes of security telemetry from endpoint, identity, cloud, network, and monitoring platforms to uncover activity that existing alerts miss. - Investigate identity and cloud threats, including stolen tokens, session abuse, authentication bypass, suspicious application permissions, and unauthorized access to cloud workloads. - Convert findings into detection rules, response automation, and improved telemetry collection in partnership with engineering and incident response teams. - Use AI-assisted analysis to speed up query creation, log review, entity investigation, and discovery of unusual patterns; assess risks in AI systems and related infrastructure. - Support adversary simulations and investigations, share findings with technical and executive audiences, and mentor other hunters.

Requirements - At least seven years in security operations, including four or more years focused on threat hunting. - Experience conducting hunts in large, complex environments and documenting outcomes that lead to detection improvements. - Hands-on experience with modern SIEM and endpoint detection and response platforms. - Demonstrated use of AI or large language model tools to support hunting, triage, or investigation. - Ability to work across enterprise, cloud, identity, and network telemetry and communicate findings clearly.

Nice to have Experience with deception operations, custom investigation tooling, purple team exercises, and cloud or AI security investigations would be useful. The listing also references experience with adversary emulation tools and established models for analyzing attacker behavior.

Benefits and work setup For eligible employees working from home, the source describes a technology setup and monthly connectivity reimbursement. A private workspace and reliable internet are expected.