Cyber Threat Hunter

We are looking for a skilled Cyber Threat Hunter to proactively identify, analyze, and mitigate advanced cyber threats across enterprise and cloud environments. The ideal candidate will have hands-on experience in threat hunting, detection engineering, SIEM/XDR platforms, cloud security, and threat intelligence-driven investigations.

Key Responsibilities:

• Conduct hypothesis-based threat hunting across endpoint, network, identity, cloud, and SaaS environments.

• Perform threat investigations using MITRE ATT&CK framework aligned hunt methodologies.

• Detect stealthy attack patterns including:

• Living-off-the-land (LOTL) techniques

• Credential abuse

• Lateral movement

• Command & Control (C2) activity

• Develop and optimize detection logic within SIEM/XDR platforms (Cortex XSIAM preferred).

• Collaborate with SOC, Incident Response, Cyber Operations, and Security Engineering teams.

• Perform deep-dive investigations and provide threat scoping, root cause analysis, and actionable recommendations.

• Correlate telemetry with Threat Intelligence Feeds to identify emerging threats and attack campaigns.

• Support alert tuning, detection improvement, and false positive reduction.

• Contribute to playbooks, SOPs, hunting frameworks, and security program maturity.

Required Skills:

• 36 years of cybersecurity experience with strong Threat Hunting expertise.

• Hands-on experience in SIEM/XDR platforms, log analysis, and security telemetry.

• Strong understanding of:

• Threat Hunting

• Detection Engineering

• Incident Investigation

• MITRE ATT&CK Framework

• Endpoint, Network, Identity & Cloud Security

• Experience with KQL, Python, PowerShell, or Bash scripting.

• Good analytical, investigation, and documentation skills.

Preferred Skills:

• Hands-on experience with Palo Alto Cortex XSIAM.

• Strong exposure to Microsoft Azure Security:

• Entra ID (Azure AD)

• Azure IaaS / PaaS

• Defender for Cloud / Endpoint

• Sign-In Logs, Audit Logs, Azure Activity Logs

• Experience correlating cloud, endpoint, and identity signals.

• Exposure to Threat Intelligence Platforms (TIPs), Malware Analysis, or OSINT.

Preferred Certifications:

• GCED / GCIA / GCIH / GPEN / OSCP / GWAPT
• Security+ / CySA+ or equivalent