Threat Hunter

Role Summary

You will execute proactive hunts across endpoint, network, cloud, identity, and SaaS telemetry to uncover stealthy threats that bypass preventive controls. Partnering closely with SOC (L1/L2), Incident Response (IR), Threat Intelligence (CTI), and Detection Engineering, youll formulate hunting hypotheses, develop detections, and drive rapid containment while continuously improving our visibility and signal fidelity.
Primary platforms: Google SecOps, CrowdStrike NG-SIEM, plus leading EDR/XDR tools (CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black).

Responsibilities

• Formulate and test hypotheses using attacker TTPs, CTI signals, behavioural analytics, and anomaly baselines; pivot across endpoint events, identity signals, DNS/Proxy, Firewall, Email security, and cloud logs.
• Perform structured hunts using queries, Sigmastyle logic, and EDR telemetry; document approach, evidence, and conclusions.
• Translate hunt outcomes into detections/usecases (UDM rules, Sigma), enrich with TI, and calibrate thresholds; publish runbooks and suppression guidance.
• Propose and collaborate on SOAR playbooks for repetitive triage and containment workflows (e.g., isolate host, disable account, revoke refresh tokens).
• Conduct full digital forensics investigations on host systems and network infrastructures.
• Analyse digital evidence, perform memory, disk, and network forensics, and extract artefacts to understand the nature of security incidents.
• Perform malware analysis using both static and dynamic techniques to determine functionality, persistence mechanisms, and potential impact on systems.
• Lead deepdive triage of stealthy detections: inspect processes, memory artifacts, PowerShell, WMI, scheduled tasks, registry, lateral movement paths; perform rootcause analysis and recommend eradication measures.
• Partner with IR to validate containment actions, confirm eradication, and capture postincident huntback tasks.
• Identify telemetry gaps; advocate new log sources, sensor policy changes, and enrichment (TI feeds, asset context).
• Track detection efficiency and falsepositive drivers; iterate content to improve precision & recall.
• Contribute to tabletop exercises/purple teaming alongside offensive security to validate defenses and hunt readiness.
• Produce weekly hunt summaries, monthly trend reports, and executive dashboards; maintain evidence repositories and knowledge articles for reuse by SOC analysts.

MustHave Qualifications

• Experience: 3–4 years in Threat Hunting/SOC/IR with measurable outcomes in proactive hunts and detection creation.
• Frameworks & Tradecraft: Strong command of MITRE ATT\&CK, kill chain, adversary emulation, and hypothesisdriven hunting.
• Networking & OS: Solid foundation in networking protocols and operating systems (Windows/Linux) with understanding of security implications.
• Platforms & Tools:
• SIEM: Google SecOps, CrowdStrike, Splunk, Sumo Logic; comfort with UDM and query development.
• EDR/XDR: CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black.
• Detection Content: Sigma rules; familiarity with YARA for artifacts/malware indicators.
• Scripting & Querying: Proficiency with Python/PowerShell and data querying (UDM, SPL, KQL or equivalent).
• Cloud & Identity: Working knowledge of Azure/AWS logging, IAM signals, and SaaS telemetry mapping.
• Communication: Crisp written and verbal skills; ability to brief both engineers and executives.

GoodtoHave

• Experience with purple teaming, adversary emulation, and memory forensics; exposure to malware behaviour analysis.
• Prior work in regulated industries (BFSI, Telecom, Healthcare, Manufacturing) with compliance-aware operations.
• Certifications: GCFA, GCIH, CTIA, Threat Hunting Specialist, Azure Security (SC200/SC300) or equivalent.

KPIs & Performance Metrics

• Hunt Cadence & Yield: Hunts executed per month; new detections per quarter mapped to ATT\&CK.
• Signal Quality: Truepositive rate, falsepositive reduction trend; MTTD/MTTR contribution deltas post tuning.
• Coverage & Gaps: % of priority ATT\&CK techniques covered; number of closed visibility gaps (new sources/enrichments).
• Automation Impact: Playbooks created/enhanced; average manual steps removed per workflow.
• Operational Hygiene: Completeness of documentation/runbooks; ontime delivery of weekly/monthly reports.