Thread Hunting

Role: Threat Hunting

Experience: 5+ Years

Location: Hyderabad

Mode of Interview: Virtual

Job Description (JD):

• Design and execute hypothesis-driven and IOC intelligence-led hunts across endpoint, identity, network, email, SaaS and cloud telemetry.
• Experience in threat hunting, threat intelligence, incident response, and SIEM detection engineering.
• Develop threat hunting hypotheses based on current threat intelligence and frameworks such as MITRE ATT&CK.
• Analyze logs from SIEM, EDR/XDR, network, cloud, and identity sources. 
  Investigate suspicious behaviors, anomalous user activity, and potential indicators of compromise (IOCs).
• Perform malware triage and behavioral analysis when required.
• Identify attacker persistence mechanisms, privilege escalation, lateral movement, and command-and-control (C2) activity.
• Create and optimize detection rules, correlation logic, and behavioral analytics. 
  Collaborate with SOC analysts, Incident Response, Detection Engineering, Vulnerability Management, and Threat Intelligence teams.
• Develop new hunting queries and automation to improve threat detection. 
  Validate security controls and identify detection gaps.
• Document findings, root cause, recommendations, and lessons learned. 
  Support incident response during active security incidents.
• Track emerging threats, zero-day vulnerabilities, and adversary campaigns.
• Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence, credential misuse and stealthy command-and-control activity.
• Demonstrated ability to write detection logic in at least one enterprise SIEM or XDR platform e.g. CrowdStrike NG-SIEM (LogScale/CQL).
• Hands-on EDR analysis, behavioural anomaly detection and investigation of post-exploitation activity.
• Strong Windows internals and Linux fundamentals: process ancestry, LOLBins, registry and service persistence, WMI, PowerShell abuse, credential theft.
• Scripting in Python and/or PowerShell for automation, log parsing and investigative tooling.
• Dark web monitoring for leaked credentials, lookalike phishing websites, and internal data
• Digital risk protection platforms: ZeroFox, Rapid 7 Insights, Flashpoint, Intel471 

Required Skills 

• Strong understanding of the Cyber Kill Chain and MITRE ATT&CK. 
• Knowledge of Windows, Linux, macOS, and Active Directory security. 
• Experience with EDR/XDR platforms (such as CrowdStrike Falcon, Microsoft Defender, SentinelOne). 
• Experience with SIEM platforms (Splunk, Microsoft Sentinel, CrowdStrike NG SIEM, QRadar, Elastic, etc.). 
• Knowledge of network protocols (DNS, HTTP/S, SMB, LDAP, RDP, SSH, Kerberos). 
• Experience analyzing Windows Event Logs, Sysmon, PowerShell, and authentication logs. 
• Ability to create hunting queries using KQL, SPL, SQL, LogScale, or similar query languages. 
• Familiarity with IOC, IOA, YARA, Sigma, and detection engineering. 
• Basic malware analysis and forensic investigation skills. 
• Scripting experience in Python or PowerShell is preferred. 
• Understanding of cloud security (AWS, Azure, GCP).