Lead Threat Hunter
Core
Lead hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments to identify adversary tradecraft and reduce dwell time.
Role type
Senior IC threat hunter (lead)
Builds
Durable detection logic, signatures, SOAR playbooks, and post-hunt reports tied to exposure reduction.
Domain
Cybersecurity / Threat Intelligence / Cloud Security / AI Security
Deliverable
production ML models
Required skills
MITRE ATT&CK, SIEM (Splunk, Sentinel, Elastic), EDR/XDR (CrowdStrike, Defender), Python, PowerShell, GO, Bash, CQL/KQL/SPL, Sigma, YARA, Snort/Suricata, AI/LLM-assisted tooling, Identity security (Entra ID, AD, SaaS), Cloud security (AWS, Azure, M365), Deception operations, Purple teaming, Scripting automation, Behavioral analysis
Preferred skills
Malware analysis, Reverse engineering, Vulnerability research, Container/Kubernetes security, OT/IoT security, Insider threat hunting, Threat hunting maturity models
Technologies
Splunk, Microsoft Sentinel, Elastic, CrowdStrike, Defender, SentinelOne, Tanium, Entra ID, Active Directory, AWS, Azure, M365, Security Copilot, Atomic Red Team, CALDERA, Stratus Red Team, MITRE ATLAS
Responsibilities
Lead hunt campaigns from formulation to reporting; Design custom analytics for large-scale telemetry; Perform identity-centric and cloud-native hunting; Convert findings into detections and SOAR playbooks; Execute deception operations; Leverage AI/LLM tooling for query generation and pattern discovery; Hunt within AI/LLM environments (prompt injection, model abuse); Produce post-hunt reports; Partner with Threat Intelligence and IR; Mentor junior hunters; Develop custom tooling and automation; Support purple team exercises.
Seniority
Senior, hands-on IC with leadership/mentorship
