Cyber Threat Hunter

We are looking for a skilled Cyber Threat Hunter to proactively identify, analyze, and mitigate advanced cyber threats across enterprise and cloud environments. The ideal candidate will have hands-on experience in threat hunting, detection engineering, SIEM/XDR platforms, cloud security, and threat intelligence-driven investigations.

Key Responsibilities:

• Conduct hypothesis-based threat hunting across endpoint, network, identity, cloud, and SaaS environments.
• Perform threat investigations using MITRE ATT&CK framework aligned hunt methodologies.
• Detect stealthy attack patterns including:
• Living-off-the-land (LOTL) techniques
• Credential abuse
• Lateral movement
• Command & Control (C2) activity
• Develop and optimize detection logic within SIEM/XDR platforms (Cortex XSIAM preferred).
• Collaborate with SOC, Incident Response, Cyber Operations, and Security Engineering teams.
• Perform deep-dive investigations and provide threat scoping, root cause analysis, and actionable recommendations.
• Correlate telemetry with Threat Intelligence Feeds to identify emerging threats and attack campaigns.
• Support alert tuning, detection improvement, and false positive reduction.
• Contribute to playbooks, SOPs, hunting frameworks, and security program maturity.

Required Skills:

• 36 years of cybersecurity experience with strong Threat Hunting expertise.
• Hands-on experience in SIEM/XDR platforms, log analysis, and security telemetry.
• Strong understanding of:
• Threat Hunting
• Detection Engineering
• Incident Investigation
• MITRE ATT&CK Framework
• Endpoint, Network, Identity & Cloud Security
• Experience with KQL, Python, PowerShell, or Bash scripting.
• Good analytical, investigation, and documentation skills.

Preferred Skills:

• Hands-on experience with Palo Alto Cortex XSIAM.
• Strong exposure to Microsoft Azure Security:
• Entra ID (Azure AD)
• Azure IaaS / PaaS
• Defender for Cloud / Endpoint
• Sign-In Logs, Audit Logs, Azure Activity Logs
• Experience correlating cloud, endpoint, and identity signals.
• Exposure to Threat Intelligence Platforms (TIPs), Malware Analysis, or OSINT.

Preferred Certifications:

• GCED / GCIA / GCIH / GPEN / OSCP / GWAPT
• Security+ / CySA+ or equivalent