Threat Hunting Lead

Role overview

Lead intelligence-driven threat hunting for a large consumer finance environment. You’ll set hunt priorities, investigate suspicious activity across endpoint, identity, network, email, and cloud data, and ensure useful findings become deployed detections. The role combines hands-on analysis, team leadership, and direct communication with client security leaders.

Responsibilities

- Build a hunt plan from threat intelligence, recent incidents, and known gaps in telemetry; prioritize hypotheses for investigation. - Conduct scheduled and ad hoc hunts across security and cloud data, focusing on techniques such as credential abuse, living-off-the-land activity, and lateral movement. - Map investigations to MITRE ATT&CK and support the SOC with broader searches during major incidents. - Work with detection engineering to convert findings into backlog items and follow through to deployment. - Document what each hunt tested, found, ruled out, or could not assess, and present results to security leadership. - Direct and mentor analysts across two locations, reviewing their hypotheses, investigative methods, and query quality.

Requirements

- At least five years in threat hunting, senior investigation, or incident response, with examples of hunts taken from hypothesis to outcome. - Strong querying skills in a SIEM or data platform such as Elastic, Splunk, Sentinel, or an equivalent, including analysis of large datasets. - Working knowledge of MITRE ATT&CK and investigative skill with credential or session abuse, lateral movement, and living-off-the-land techniques. - Experience leading or mentoring analysts, including across locations, and confidence presenting findings to client security leaders. - Fluent English at approximately B2+ or C1 level. - Ability to pass recurring identity, background, employment, and education checks; permanent authorization to work in the country of residence is required, with no visa sponsorship available.

Nice to have

- Elastic EQL or ES|QL, deep EDR experience, or hunting across identity and AWS data. - Threat intelligence platforms, Python, Jupyter, detection writing, or knowledge of financial-sector threats such as fraud, ransomware, and business email compromise. - Relevant threat hunting, incident response, or intelligence certifications.

Benefits and work setup

Full-time, hybrid work based in Bogotá or Buenos Aires: two days per week in the office and three from home, with in-person attendance for important meetings. The schedule follows US Eastern business hours without shift rotation, though major incidents may require additional involvement.