Principal Threat Hunter | Remote, USA

Role overview

Lead threat hunting and incident analysis for client environments, helping identify suspicious activity, coordinate response, and improve defensive controls. The principal-level role combines hands-on investigation with client communication, technical leadership, and mentoring across a round-the-clock security operation.

Responsibilities

- Investigate, document, and report potential security incidents using client data and open-source intelligence. - Coordinate with clients during urgent events, supporting containment, remediation, and clear communication of risk. - Assess gaps and effectiveness across monitoring, endpoint, network, vulnerability, and automation platforms; recommend improvements. - Apply threat frameworks and adversary techniques to guide hunts, detection content, mitigations, and policy recommendations. - Mentor analysts and partner teams, while maintaining procedures and knowledge materials for investigation and response. - Evaluate emerging security technologies and advise clients on practical ways to strengthen their security posture.

Requirements

- At least eight years in incident response, defensive or offensive security operations, or a related technical area, together with a relevant degree or documented equivalent training. - Leadership experience developing people or operations and delivering projects or solving complex problems. - Experience in at least three areas such as incident response, detection engineering, malware or network analysis, threat intelligence, penetration testing, forensics, or threat emulation. - Working knowledge of threat models such as MITRE ATT&CK, the Cyber Kill Chain, Pyramid of Pain, or Diamond Model; familiarity with Windows and Linux internals. - Scripting ability in languages such as Python, PowerShell, or Bash, and experience applying tools in a threat hunting lifecycle. - Strong communication skills, including presenting technical findings clearly to varied audiences.

Nice to have

- Relevant security certifications and experience with security platforms, tool integrations, data correlation, and automation. - A combination of offensive and defensive security experience.

Benefits and work setup

- Fully remote within the continental United States. - The team operates 24/7, with shifts rotating among day, mid, and night schedules. - Professional training, remote-work technology, volunteer opportunities, and employee resource groups are listed.