Threat Hunting & Intelligence Lead

As the Threat Hunting & Intelligence Lead, you will be a senior security specialist responsible for designing, establishing, and leading an intelligence-led threat hunting capability across the managed security service. This role combines hands-on technical excellence, analyst development, and client-facing leadership to deliver proactive security outcomes beyond traditional SOC alerting.You will reshape the threat hunting programme from the ground up, defining AI enabled methodologies, telemetry requirements, and measures of success before evolving into ongoing hunting execution, coaching analysts, and acting as a trusted advisor to clients and internal stakeholders. The role blends offensive attacker-mindset insight with deep defensive detection and response expertise, making it a key differentiator for both service delivery and pre-sales engagements.Key ResponsibilitiesThreat Hunting Programme DevelopmentDesign and establish a formal, repeatable threat hunting programme, including:Hunting methodologies and frameworksHypothesis-driven hunting modelsTooling, data sources, and telemetry requirementsClear success metrics and measurable outcomesDefine and embed how threat hunting integrates with:SIEM detections and detection engineeringSOC operations and workflowsIncident response processesIntelligence-led prioritisation and use-case developmentEnsure hunting outputs directly inform continuous service improvement.Hands-On Threat Hunting & IntelligenceConduct advanced, hands-on threat hunts in the Microsoft Eco System Primarily across:Endpoint (EDR/XDR)Identity and authentication telemetryCloud platforms and SaaS environmentsSIEM and log-based data sourcesApply offensive security tradecraft (attacker TTPs, kill chains, evasion techniques) to uncover threats that bypass automated detections.Translate hunting and intelligence outcomes into:New or improved detection casesAutomation opportunitiesSOC operational enhancementsDetection coverage and fidelity improvementsMaintain strong awareness of the current threat landscape, adversary behaviours, and emerging attack techniques.Analyst Coaching & Capability UpliftCoach and mentor SOC analysts through collaborative hunting, developing:Threat-led and adversary-focused thinkingStrong investigative depth and analytical reasoningConfidence in hypothesis-driven analysisLead hunts in a collaborative model, uplifting analyst capability rather than operating as a siloed expert.Embed a continuous learning culture where hunting outcomes directly improve detections, response playbooks, and analyst maturity.Act as a client-facing authority for threat hunting and threat intelligence, able to:Explain hunting outcomes in clear, business-relevant languageDemonstrate how proactive hunting reduces risk beyond reactive alertingArticulate the value of intelligence-led security operationsServe as a trusted advisor during service reviews, executive briefings, and strategic engagements.Technical Leadership & CollaborationDemonstrate deep technical expertise across:SIEM platformsEDR/XDR technologiesCloud security platformsIdentity and access telemetryWork closely with:Detection Engineering teamsPlatform Automation and EngineeringSOC leadership and incident response leadsEnsure threat hunting insights drive tangible, measurable service improvements. Equal Employment Opportunity Statement All employment decisions shall be made without regard to age, race, creed, color, religion, sex, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status or any other basis as protected by federal, state, or local law. Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process. Avanade is committed to providing veteran employment opportunities to our service men and women. Please read Avanade's Hiring and Privacy Statement for more information on how we process your data during the Recruiting and Hiring process.