Thread Hunting

Role: Threat Hunting

Experience: 5+ Years

Location: Hyderabad

Mode of Interview: Virtual

Job Description (JD):

• Design and execute hypothesis-driven and IOC intelligence-led hunts across endpoint, identity, network, email, SaaS and cloud telemetry.
• Experience in threat hunting, threat intelligence, incident response, and SIEM detection engineering.
• Develop threat hunting hypotheses based on current threat intelligence and frameworks such as MITRE ATT&CK.
• Analyze logs from SIEM, EDR/XDR, network, cloud, and identity sources.
  Investigate suspicious behaviors, anomalous user activity, and potential indicators of compromise (IOCs).
• Perform malware triage and behavioral analysis when required.
• Identify attacker persistence mechanisms, privilege escalation, lateral movement, and command-and-control (C2) activity.
• Create and optimize detection rules, correlation logic, and behavioral analytics.
  Collaborate with SOC analysts, Incident Response, Detection Engineering, Vulnerability Management, and Threat Intelligence teams.
• Develop new hunting queries and automation to improve threat detection.
  Validate security controls and identify detection gaps.
• Document findings, root cause, recommendations, and lessons learned.
  Support incident response during active security incidents.
• Track emerging threats, zero-day vulnerabilities, and adversary campaigns.
• Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence, credential misuse and stealthy command-and-control activity.
• Demonstrated ability to write detection logic in at least one enterprise SIEM or XDR platform e.g. CrowdStrike NG-SIEM (LogScale/CQL).
• Hands-on EDR analysis, behavioural anomaly detection and investigation of post-exploitation activity.
• Strong Windows internals and Linux fundamentals: process ancestry, LOLBins, registry and service persistence, WMI, PowerShell abuse, credential theft.
• Scripting in Python and/or PowerShell for automation, log parsing and investigative tooling.
• Dark web monitoring for leaked credentials, lookalike phishing websites, and internal data
• Digital risk protection platforms: ZeroFox, Rapid 7 Insights, Flashpoint, Intel471

Required Skills

• Strong understanding of the Cyber Kill Chain and MITRE ATT&CK.
• Knowledge of Windows, Linux, macOS, and Active Directory security.
• Experience with EDR/XDR platforms (such as CrowdStrike Falcon, Microsoft Defender, SentinelOne).
• Experience with SIEM platforms (Splunk, Microsoft Sentinel, CrowdStrike NG SIEM, QRadar, Elastic, etc.).
• Knowledge of network protocols (DNS, HTTP/S, SMB, LDAP, RDP, SSH, Kerberos).
• Experience analyzing Windows Event Logs, Sysmon, PowerShell, and authentication logs.
• Ability to create hunting queries using KQL, SPL, SQL, LogScale, or similar query languages.
• Familiarity with IOC, IOA, YARA, Sigma, and detection engineering.
• Basic malware analysis and forensic investigation skills.
• Scripting experience in Python or PowerShell is preferred.
• Understanding of cloud security (AWS, Azure, GCP).