L3 Threat Hunter – Proactive Breach Detection

About the role

We are looking for a highly skilled L3 Threat Hunter to join a leading Cyber Defense team. The role focuses on proactively identifying advanced threats, conducting hypothesis‑driven hunting, and strengthening detection capabilities across enterprise environments.

Key responsibilities

• Conduct proactive threat hunting across endpoints, networks, cloud, and SIEM platforms.
• Lead investigations of APTs, insider threats, malware, lateral movement, and privilege escalation.
• Correlate telemetry from SIEM, EDR/XDR, IDS/IPS, firewalls, and threat intelligence sources.
• Develop and automate hunting workflows, detection use cases, and response playbooks.
• Act as primary threat hunter during security incidents and support incident response.
• Perform forensic analysis on systems, memory, logs, and network artifacts.
• Collaborate with SOC, DFIR, Red Team, and Detection Engineering to improve coverage and reduce dwell time.
• Map attacker TTPs to MITRE ATT&CK and create actionable detections.
• Run threat simulations and validate detection logic.
• Produce technical reports, executive summaries, and remediation recommendations.

Required profile

• Minimum 5 + years of hands‑on cybersecurity experience, focused on threat hunting.
• Proven ability to lead hunting engagements independently.
• Experience participating in incident response as the primary hunter.
• Strong exposure to enterprise SOC operations.
• Bachelor’s degree in Cybersecurity, Computer Science, or related field (preferred).
• Relevant certifications such as eCTHP, eCIR, GONG, CFA, or OS (preferred).

Required skills

• SIEM platforms: Splunk, Microsoft Sentinel, QRadar, ArcSight, Elastic.
• EDR/XDR solutions: CrowdStrike, Defender, Carbon Black, SentinelOne.
• IDS/IPS technologies.
• Threat intelligence platforms.
• Digital forensics and log analysis.
• Threat hunting methodologies, data correlation, anomaly detection.
• Malware analysis fundamentals.
• Windows/Linux attack techniques.
• Network traffic analysis.
• MITRE ATT&CK framework.
• Scripting/automation: Python, PowerShell, Bash.
• Exposure to Red Teaming or penetration testing (preferred).