Advanced Threat Hunting

Key Responsibilities

- Develop and execute hypothesis-driven threat hunting campaigns across enterprise infrastructure

- Design threat hunting frameworks aligned with MITRE ATT&CK methodology

- Formulate actionable hypotheses based on threat intelligence and attack vectors

- Conduct deep forensic analysis using logs, network traffic, and system artifacts

- Build detection queries and signatures for identified threats and TTPs (Tactics, Techniques, Procedures)

- Collaborate with SOC, incident response, and threat intelligence teams

- Create threat hunting runbooks and operationalize hunting findings

- Analyze and profile attacker behaviors, attack chains, and persistence mechanisms

- Deliver threat hunting insights and recommendations to stakeholders and leadership

- Mentor and train SOC analysts on advanced hunting techniques and methodologies

- Participate in incident investigations requiring specialized hunting skills

- Maintain and update threat models based on emerging threats and industry trends

Required Qualifications

- 3-7 years of hands-on experience in advanced threat hunting and incident response

- Proven expertise in hypothesis-driven threat hunting methodologies

- Strong understanding of MITRE ATT&CK framework and threat actor TTPs

- Advanced proficiency with threat hunting tools (Splunk, Elasticsearch, Wireshark, Zeek, osquery)

- Deep knowledge of Windows, Linux, and network-level forensics

- Experience with log analysis, packet analysis, and endpoint artifacts

- Understanding of attack chains, lateral movement, and data exfiltration techniques

- Proficiency in query languages (SPL, KQL, YARA rules, regular expressions)

- Strong analytical and investigative skills with attention to detail

Desired Skills

- GIAC Certified Incident Handler (GCIH) or GIAC Certified Intrusion Analyst (GCIA)

- Certified Threat Intelligence Professional (CTIP) or equivalent

- Scripting proficiency (Python, PowerShell, Bash) for data processing and automation

- Experience with threat intelligence platforms and frameworks

- Knowledge of C2 frameworks, malware analysis, and reverse engineering

- Hands-on experience with EDR platforms (CrowdStrike, Carbon Black, Defender)

- Cloud infrastructure security hunting (AWS, Azure, GCP)

- Threat modeling and risk assessment expertise