Cyber Threat Hunter

Job description

We are looking for a skilled Cyber Threat Hunter to proactively identify, analyze, and mitigate advanced cyber threats across enterprise and cloud environments. The ideal candidate will have hands-on experience in threat hunting, detection engineering, SIEM/XDR platforms, cloud security, and threat intelligence-driven investigations. Key Responsibilities: • Conduct hypothesis-based threat hunting across endpoint, network, identity, cloud, and SaaS environments. • Perform threat investigations using MITRE ATT&CK framework aligned hunt methodologies. • Detect stealthy attack patterns including: • Living-off-the-land (LOTL) techniques • Credential abuse • Lateral movement • Command & Control (C2) activity • Develop and optimize detection logic within SIEM/XDR platforms (Cortex XSIAM preferred). • Collaborate with SOC, Incident Response, Cyber Operations, and Security Engineering teams. • Perform deep-dive investigations and provide threat scoping, root cause analysis, and actionable recommendations. • Correlate telemetry with Threat Intelligence Feeds to identify emerging threats and attack campaigns. • Support alert tuning, detection improvement, and false positive reduction. • Contribute to playbooks, SOPs, hunting frameworks, and security program maturity. Required Skills: • 36 years of cybersecurity experience with strong Threat Hunting expertise. • Hands-on experience in SIEM/XDR platforms, log analysis, and security telemetry. • Strong understanding of: • Threat Hunting • Detection Engineering • Incident Investigation • MITRE ATT&CK Framework • Endpoint, Network, Identity & Cloud Security • Experience with KQL, Python, PowerShell, or Bash scripting. • Good analytical, investigation, and documentation skills. Preferred Skills: • Hands-on experience with Palo Alto Cortex XSIAM. • Strong exposure to Microsoft Azure Security: • Entra ID (Azure AD) • Azure IaaS / PaaS • Defender for Cloud / Endpoint • Sign-In Logs, Audit Logs, Azure Activity Logs • Experience correlating cloud, endpoint, and identity signals. • Exposure to Threat Intelligence Platforms (TIPs), Malware Analysis, or OSINT. Preferred Certifications: • GCED / GCIA / GCIH / GPEN / OSCP / GWAPT • Security+ / CySA+ or equivalent