Advanced Threat Hunting

Key Responsibilities

• Develop and execute hypothesis-driven threat hunting campaigns across enterprise infrastructure

• Design threat hunting frameworks aligned with MITRE ATT&CK methodology

• Formulate actionable hypotheses based on threat intelligence and attack vectors

• Conduct deep forensic analysis using logs, network traffic, and system artifacts

• Build detection queries and signatures for identified threats and TTPs (Tactics, Techniques, Procedures)

• Collaborate with SOC, incident response, and threat intelligence teams

• Create threat hunting runbooks and operationalize hunting findings

• Analyze and profile attacker behaviors, attack chains, and persistence mechanisms

• Deliver threat hunting insights and recommendations to stakeholders and leadership

• Mentor and train SOC analysts on advanced hunting techniques and methodologies

• Participate in incident investigations requiring specialized hunting skills

• Maintain and update threat models based on emerging threats and industry trends

Required Qualifications

• 3-7 years of hands-on experience in advanced threat hunting and incident response

• Proven expertise in hypothesis-driven threat hunting methodologies

• Strong understanding of MITRE ATT&CK framework and threat actor TTPs

• Advanced proficiency with threat hunting tools (Splunk, Elasticsearch, Wireshark, Zeek, osquery)

• Deep knowledge of Windows, Linux, and network-level forensics

• Experience with log analysis, packet analysis, and endpoint artifacts

• Understanding of attack chains, lateral movement, and data exfiltration techniques

• Proficiency in query languages (SPL, KQL, YARA rules, regular expressions)

• Strong analytical and investigative skills with attention to detail

Desired Skills

• GIAC Certified Incident Handler (GCIH) or GIAC Certified Intrusion Analyst (GCIA)

• Certified Threat Intelligence Professional (CTIP) or equivalent

• Scripting proficiency (Python, PowerShell, Bash) for data processing and automation

• Experience with threat intelligence platforms and frameworks

• Knowledge of C2 frameworks, malware analysis, and reverse engineering

• Hands-on experience with EDR platforms (CrowdStrike, Carbon Black, Defender)

• Cloud infrastructure security hunting (AWS, Azure, GCP)

• Threat modeling and risk assessment expertise