Senior Threat Hunter / Detection Engineer

Roles & Responsibilities

• Conduct hypothesis-driven threat hunts across endpoints, identities, networks, and security data sources.
• Leverage Microsoft Defender for Endpoint (MDE) and Microsoft 365 Defender (XDR) for threat investigation, hunting, and automated response.
• Develop advanced Kusto Query Language (KQL) queries for threat hunting and detection.
• Use Splunk Enterprise Security and SPL to perform complex security investigations, correlation, and threat hunting.
• Develop and tune high-fidelity detection rules while minimizing false positives.
• Apply the MITRE ATT&CK framework to threat hunting, detection engineering, and adversary analysis.
• Translate threat intelligence and attack research into actionable detection and hunting use cases.
• Investigate security incidents using endpoint forensics, malware analysis, and security analytics.
• Support containment, eradication, and recovery activities for complex incidents.
• Develop and maintain incident response playbooks, procedures, and technical documentation.
• Preserve forensic evidence and follow appropriate evidence-handling and chain-of-custody practices.
• Analyze Windows systems, processes, authentication activity, network traffic, and common attack vectors.
• Develop scripts and automation using PowerShell, Python, or similar technologies.
• Collaborate with incident response, detection engineering, IT operations, and other security teams.
• Provide technical training, mentoring, and knowledge transfer to security teams.
• Develop training materials and explain complex security concepts to audiences with varying technical skill levels.
• Identify opportunities to improve security tools, processes, detections, and threat-hunting capabilities.
• Support security tool implementations, migrations, and optimization initiatives.

Required Skills

• 5–7+ years of cybersecurity experience with a focus on threat hunting, detection engineering, and/or incident response.
• At least 2 years of hands-on enterprise experience with Microsoft Defender for Endpoint (MDE).
• Strong experience with Microsoft 365 Defender/XDR and MDE investigation capabilities.
• Advanced KQL skills for threat hunting and detection development.
• Expert-level experience with Splunk Enterprise Security and strong SPL skills.
• Experience with Splunk UBA or similar behavioral analytics platforms.
• Strong knowledge of MITRE ATT&CK, adversary TTPs, and threat intelligence.
• Demonstrated experience conducting threat hunts that resulted in actionable security improvements.
• Hands-on experience with incident response, endpoint forensics, and malware analysis.
• Strong understanding of Windows internals, Active Directory, Azure AD, Kerberos, and NTLM.
• Knowledge of network protocols, traffic analysis, and common attack techniques.
• Experience with scripting or automation using PowerShell, Python, or similar languages.
• Strong analytical, problem-solving, documentation, and communication skills.
• Ability to work independently and collaborate effectively with distributed, cross-functional teams.

Preferred Skills

• Experience supporting or leading security tool migrations or implementations.
• Experience with Splunk UBA, SIEM architecture, data onboarding, and platform optimization.
• Knowledge of NIST and SANS incident response frameworks.
• Experience developing incident response playbooks and security procedures.
• Experience with detection engineering and reducing false positives.
• Strong technical training, mentoring, and knowledge-transfer experience.
• Ability to translate threat research into practical defensive controls and security improvements.
• Experience working in a fully remote and distributed team environment.