Senior Cyber Threat Hunter

Position Profile: SeniorCyber Threat Hunter

Position Summary:

Under the direction of the Director of the Cyber Threat Action Center, theSenior Cyber Threat Hunterwill serve in atechnical role reporting directly to the Director of the Cyber Threat Action Center. This role will use threat intelligence to drive proactive hunting activities in our enterprise, and create threat intelligence by driving advanced threat research. In the threat hunting functions the role will also use threat intelligence to design and spearhead Tactics, Techniques, and Procedures (TTP)-based threat hunts across the organization to identify and mitigate potential risks before they materialize.

The threat research function will be focused on investigating threat actors through analysis pf dark web and underground hacker forums, analyzing diverse threat intelligence sources, researching adversary infrastructure, and reverse engineering malware

The Senior Cyber Threat Hunterrolewill also play a critical role in supporting major cyber incident responses and contributing to threat intelligence products that strengthen the organization's defenses. As a key advisor to the Director of the Cyber Threat Action Center, the Director of Cyber Defense Operations, and other IT leaders, the analyst will provide expert insights into threat actor behaviors, emerging threats, and mitigation strategies. Strong executive-level communication skills, both written and verbal, are essential to effectively convey findings and recommendations.

In addition to technical responsibilities, the role includes mentoring junior team members, ensuring the team stays at the forefront of threat research, threat intelligence, and threat hunting practices. As a technical senior, the analyst will also collaborate closely with IT leadership to provide guidance on evolving threat trends and will play a central role in shaping the organizations overall threat research and hunting strategies. This position requires a combination of deep technical expertise, leadership capabilities, and vision to enhance the organizations cyber defense posture.

Job Responsibilities

Threat Hunting:

• Designs and executes the continuous enhancement of the enterprise threat hunting program, ensuring alignment with organizational security objectives.
• Develops hypotheses based on adversary behavior, threat intelligence, anomaly patterns, and attack surface weaknesses to drive proactive hunts.
• Designs and executes TTP-based threat hunts across endpoints, cloud, identity, network, and SaaS environments to identify malicious activity or vulnerabilities.
• Measures hunt effectiveness and evolves methodologies using frameworks such as MITRE ATT&CK, D3FEND, and the cyber kill chain.

Threat Research & Adversary Analysis:

• Applies comprehensive knowledge and a thorough understanding of threat research, adversary analysis, and hunting concepts, principles, and technical capabilities.
• Executes research on emerging threats, malware families, actor TTPs, evasion techniques, and exploitation trends; stays up to date with vulnerabilities and attack techniques.
• Investigates and monitors threat actors and their activities on the dark web, underground forums, and other intelligence sources.
• Investigates and monitors threat actors infrastructure from and derives threat intelligence from it.
• Performs reverse engineering of malware samples and scripts to extract IOCs, behavioral patterns, and detection opportunities, understanding functionality, impact, and attribution.
• Publishes internal threat research reports, detection guidance, and tactical recommendations; creates and disseminates high-quality threat intelligence products for stakeholders.
• Develops and enhances threat research methodologies, tools, and processes to improve organizational detection and response capabilities.

Other:

• Collaborates with engineering teams to develop and refine security detections in SIEM, EDR/XDR, and cloud security tools.
• Partners with Incident Response, Monitoring and Triage, Cyber Threat Intelligence, and other IT teams to ensure alignment on threat detection and mitigation strategies.
• Acts as an escalation point during complex investigations and major cyber incidents, providing advanced threat analysis and supporting incident response efforts.
• Documents and presents findings from threat research and hunting activities to leadership and other stakeholders.
• Provides technical leadership and mentorship to analysts and other members of the Cyber Threat Action Center, fostering a culture of continuous learning and innovation.

Required Skills:

• Excellent verbal and written communication skills, including the ability to effectively communicate complex technical concepts to executive and non-technical audiences.
• Strong analytical and problem-solving skills, with the ability to work independently and prioritize tasks effectively.
• Deep understanding of the cyber threat landscape, including knowledge of threat actors, their motivations, and their TTPs.
• 5+ years of experience in threat research, malware analysis, threat intelligence, or similar fields.
• Proficiency in reverse engineering tools such as IDA Pro, Ghidra, or OllyDbg or similar tools.
• Strong understanding of malware analysis techniques, including static and dynamic analysis.
• Experience with threat intelligence platforms (TIPs).
• Strong knowledge of MITRE ATT&CK, cyber kill chain, and adversary emulation methodologies.
• Experience in designing and conducting TTP-based threat hunts.
• Expertise in Windows/Linux internals, cloud security, and identity-based attacks.
• Experience working with SIEM, Endpoint Detection and Response (EDR), and Network Detection and Response (NDR) tools.
• Strong sense of professionalism, ethics, and a commitment to staying current with industry trends.
• Expected to work occasional nights, weekends, holidays, and overtime.
• Expected to perform on-call duties.
• Hands-on experience analyzing EDR/XDR telemetry and writing advanced detections (KQL, Sigma, SPL, EQL, YARA, etc.).
• Proficiency in scripting and automation (Python, PowerShell, Go, etc.) to support hunt and research workflows.
• Familiarity with dark web investigation tools and techniques.
• Experience with advanced threat modeling and risk assessment frameworks.

Desired Skills:

• Certifications such as GIAC Reverse Engineering Malware (GREM), Certified Threat Intelligence Analyst (CTIA), or Offensive Security Certified Professional (OSCP),Offensive Security Certified Expert (OSCE), GIAC Penetration Tester Certification (GPEN), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Forensic Analyst (GCIA), GIAC Defending Advanced Threats (GDAT).
• Experience in threat research within SCADA, DCS, or PLC environments is a plus.
• Experience with threat research in SAP environments is a plus.
• Experience with Microsoft Defender Suite is a plus.
• Familiarity with cloud platforms (AWS, Azure, GCP) and SaaS detection techniques.

Education Requirements:

• Bachelors Degree in Cybersecurity, Computer Science, or a related field, or 5+ years of equivalent experience.

Required Experience:

• Prior experience as a senior contributor advising and help leading team efforts preferred.
• Experience in threat research and intelligence in medium to large enterprises.
• Knowledge and execution of TTP-based threat hunting.
• Proven track record in reverse engineering malware and analyzing threat actor behavior.
• Experience and understanding of best-in-class threat intelligence practices.

Desired Experience:

• Experience in advising teams in an individual contributor or lead capacity.
• Demonstrated expertise in threat actor analysis and underground forum monitoring.
• One or more Information Security Certifications preferred, but not required (e.g., GREM, CTIA, OSCP).
• Bachelors degree in related field, or equivalent work experience.

Additional Information:

• Occasional travel required.