Threat Hunting Analyst

Role overview

Conduct proactive, hypothesis-driven investigations across endpoint, identity, network, email, and cloud telemetry for a financial services environment. The analyst will turn threat intelligence into focused hunts, investigate suspicious activity, and work with detection engineers so valuable findings can become repeatable detections.

Responsibilities - Develop hunt questions with security leads, using relevant intelligence, recent incidents, and known gaps in available telemetry. - Translate attacker techniques into testable hypotheses, choose data sources and time windows, and use the MITRE ATT&CK framework to guide priorities. - Run scheduled and ad hoc investigations across security and cloud data in a SIEM; pivot on leads and distinguish meaningful activity from noise. - Escalate evidence of active attacks, and conduct indicator or behavior sweeps to assess potential incident scope. - Document candidate detections and logging gaps for engineering follow-up. - Write clear, reproducible reports describing methods, results, limitations, and steps others can use to repeat a hunt.

Requirements - At least three years as a Tier 2 or Tier 3 SOC analyst, incident responder, or threat hunter, including hands-on proactive SIEM hunting. - Ability to describe an investigation from hypothesis to outcome, including a hunt that found no malicious activity. - Experience querying large datasets in Elastic, Splunk, Microsoft Sentinel, QRadar, or a comparable SIEM. - Understanding of how living-off-the-land activity, credential or session abuse, lateral movement, and cloud control-plane misuse may appear in logs. - Strong written English for reports and spoken English at B1 level or above. - Collaborative, careful approach to investigations, including recognizing when evidence shows existing controls are working. - Ability to pass identity, criminal history, employment, and education checks; work in a clean-desk, virtual desktop environment; and be permanently authorized to work in the country of residence without current or future visa sponsorship.

Nice to have - Financial-sector threat experience, including fraud-related intrusion, ransomware, or business email compromise. - Detection writing, malware triage, or memory forensics experience; relevant threat intelligence or incident response certifications.

Benefits and work setup - Full-time, hybrid work based in Bogotá or Buenos Aires, with two office days and three work-from-home days each week, plus attendance at important in-person meetings. - Work follows US Eastern business hours, without rotating shifts; occasional call-ins may be needed during major incidents.