3-6 years of experience in cybersecurity roles, with a focus on threat hunting or incident response.
Proficient in hypothesis-driven threat hunting using HMM-4 methodologies.
Strong understanding of the MITRE ATT&CK framework and mapping adversary TTPs.
Hands-on experience with SIEM, EDR, and network traffic analysis tools.
Familiarity with cloud security in environments like AWS or Azure.
Strong analytical skills for investigating complex security events.
Relevant cybersecurity certifications (GCIH, CTIA, CThH) are a plus.
Responsibilities
Conduct proactive threat hunts using hypothesis-driven methodologies.
Develop and refine hunting hypotheses based on threat intelligence and internal data.
Analyze security telemetry from various enterprise data sources.
Identify indicators of compromise and emerging attack patterns.
Perform detailed investigations to assess threats' scope and impact.
Collaborate with cross-functional teams to enhance threat understanding.
Document findings and communicate technical results to diverse audiences.
Benefits
Opportunity to work with experienced professionals across various security domains.
Engagement in continuous learning and knowledge sharing.
Access to cutting-edge security technologies and methodologies.
Collaborative work environment focused on mission success.
Potential for professional development and certification support.
Full Job Description
Job Description
Cyber Threat Hunter to proactively identify, investigate, and mitigate sophisticated cyber threats across a large-scale enterprise environment. This role is ideal for a security professional who enjoys going beyond traditional alert response to uncover adversary activity, develop hunting hypotheses, and identify previously undetected threats.
The Cyber Threat Hunter will leverage hypothesis-based hunting methodologies, including HMM-4, and the MITRE ATT&CK framework to analyze adversary tactics, techniques, and procedures (TTPs). The position offers the opportunity to work alongside experienced professionals across endpoint security, network operations, offensive security, threat intelligence, cloud engineering, and data science.
Required Skills
Conduct proactive, hypothesis-driven threat hunts using HMM-4 methodologies and the MITRE ATT&CK framework.
Develop and refine threat-hunting hypotheses using threat intelligence, internal security data, and analysis of adversary TTPs.
Analyze security telemetry from SIEM, EDR, network traffic, endpoint systems, cloud environments, logs, and other enterprise data sources.
Identify indicators of compromise, anomalous activity, and emerging attack patterns that may indicate malicious activity.
Perform detailed investigations to determine the scope, impact, root cause, and potential business risk associated with identified threats.
Map observed adversary activity to MITRE ATT&CK techniques and identify gaps in existing defensive coverage.
Collaborate with endpoint, network, offensive security, threat intelligence, cloud, and data science teams to develop a comprehensive understanding of threats.
Document investigative objectives, hunting methodologies, findings, and investigative progress.
Develop detailed reports and communicate technical findings, risk assessments, and remediation recommendations to technical and non-technical audiences.
Recommend and develop enhanced detections and defensive measures when gaps are identified.
Stay current on emerging threats, attack techniques, vulnerabilities, security technologies, and industry best practices.
Contribute to knowledge sharing and continuous improvement of enterprise threat-hunting capabilities.
Desired Skills
Minimum of 3 years of experience as a cybersecurity analyst, incident responder, threat hunter, or in a closely related cybersecurity discipline; 4-6 years preferred.
Strong experience with hypothesis-based threat hunting and the HMM-4 methodology.
Demonstrated proficiency with the MITRE ATT&CK framework and the ability to map adversary TTPs to observed activity.
Hands-on experience with SIEM platforms, EDR solutions, network traffic analysis tools, and other security monitoring technologies.
Strong understanding of enterprise network protocols, endpoint security, and common attack methodologies.
Experience analyzing security data across cloud environments such as AWS and/or Azure.
Strong analytical and problem-solving skills with the ability to investigate complex or ambiguous security events.
Ability to clearly communicate complex technical findings, investigative conclusions, and recommended actions to both technical and non-technical audiences.
Relevant cybersecurity certifications such as GCIH, CTIA, CThH, or comparable credentials are highly desirable.
Ability to work effectively in a collaborative, mission-focused environment and adapt to evolving threat landscapes.
