Cyber Threat Hunter Lead

American Electric Power•Columbus, OH

1d•$116,255 - $151,133

About The Position

The Cyber Threat Hunter Lead directs proactive threat hunting across enterprise, cloud, identity, and operational technology environments to identify and disrupt advanced adversary activity. The role analyzes cyber threat intelligence, adversary tactics, techniques, and procedures, and emerging threat trends to assess risk and prioritize hunting efforts affecting AEP. It develops and executes hypothesis-driven hunts using MITRE ATT&CK, the Cyber Kill Chain, and intelligence-driven methodologies, and leads complex investigations involving advanced persistent threats, insider threats, ransomware, and targeted intrusions. The role serves as a senior technical advisor during incident response, providing threat analysis, scoping, forensic expertise, and remediation recommendations. It conducts advanced host, network, memory, and malware analysis; reverse engineers malware and attacker tools; and turns hunting findings into detection content and security improvements in collaboration with Detection Engineering and Security Operations. The position identifies visibility, telemetry, and security-control gaps; partners with external and internal stakeholders to enhance threat awareness and defensive readiness; and develops hunting playbooks, methodologies, and operational standards. The Cyber Threat Hunter Lead also mentors junior threat hunters and analysts, communicates technical findings and cyber risks to technical and non-technical audiences, and uses cybersecurity tooling and advanced analytics to uncover threats. It drives continuous improvement through automation, detection enhancement, adversary emulation, and lessons learned; establishes and tracks program metrics; and maintains expert-level knowledge of threat actors, attack techniques, vulnerabilities, and cybersecurity technologies.

Requirements

Bachelor's degree; alternatively, an associate degree with 2 years of relevant system administration, help desk, or security (cyber or physical) experience; or a high school diploma/GED with 4 years of relevant IT system administration, help desk, or security (cyber or physical) experience.
7 or more years of information technology-related experience, or 5 or more years of security-related experience. Military/government work experience may count toward the security-related experience requirement.

Responsibilities

Lead proactive threat hunting across enterprise, cloud, identity, and operational technology environments.
Analyze cyber threat intelligence, adversary TTPs, and emerging threat trends to assess risk and prioritize hunting efforts.
Develop and execute hypothesis-driven threat hunts using MITRE ATT&CK, the Cyber Kill Chain, and intelligence-driven methodologies.
Lead complex investigations involving advanced persistent threats, insider threats, ransomware, and targeted intrusion activity.
Provide threat analysis, scoping, forensic expertise, and remediation recommendations during cyber incident response.
Conduct advanced host, network, memory, and malware analysis to uncover adversary behavior and identify indicators of compromise.
Reverse engineer malware and attacker tools to develop intelligence, improve detections, and support threat response.
Translate hunting findings into actionable detection content, use cases, and security improvements with Detection Engineering and Security Operations teams.
Identify visibility, telemetry, and security-control gaps and recommend strategic improvements.
Partner with government agencies, intelligence-sharing organizations, industry peers, and internal stakeholders to improve threat awareness and defensive readiness.
Develop threat hunting playbooks, methodologies, and operational standards.
Mentor and coach junior threat hunters and analysts.
Communicate technical findings and cyber risks clearly to technical and non-technical audiences.
Use cybersecurity tooling and advanced analytics to uncover stealthy or previously unidentified threats.
Improve hunting capabilities through automation, detection enhancement, adversary emulation, and lessons learned.
Establish and track threat hunting metrics to measure effectiveness and guide program improvements.
Maintain expert-level knowledge of emerging threat actors, attack techniques, vulnerabilities, and cybersecurity technologies.